559/69 Monday, October 12, 2026
Cybersecurity researchers from Bitdefender have disclosed the discovery of a malware campaign named Midnight Mimosa, which comes preinstalled in the firmware of several brands of budget Android smartphones based on MediaTek platforms. The malware is embedded in the devices before users turn them on for the first time and cannot be removed through conventional uninstallation methods. The campaign has been observed affecting users in more than 150 countries worldwide. The attackers’ primary objectives are to generate revenue through ad fraud and take control of devices to build botnets that can be used as infrastructure for other types of cyberattacks.
The malware operates with system-level privileges, allowing it to silently install or remove other applications. One technique involves temporarily disabling the Google Play Store to bypass certain security controls before downloading additional applications disguised as legitimate software, such as the CoolWeather weather app, to serve as a cover for malicious activity. Analysis found that the malware often hides under package names resembling legitimate system components. In the application list, it may appear simply as “System”, accompanied by an Android icon or a generic green icon without distinctive branding. Devices with some of the highest observed infection rates were low-cost smartphone models such as the KINGKONG X, where approximately 11.33% of observed devices were affected, as well as counterfeit smartphones using the names of well-known brands and model names that do not officially exist.
Because Midnight Mimosa is deeply embedded in the device’s system partition, users cannot fully remediate the infection simply by uninstalling applications. Consumers should reduce their risk by avoiding counterfeit smartphones, devices from untrusted sources, and products using firmware from manufacturers without reliable certification or support. Users of potentially affected devices who notice abnormal system behavior or applications being installed automatically should avoid conducting financial transactions or storing sensitive information on those devices. If remediation is necessary, users should consult system administrators or qualified specialists about disabling malicious components through Android Debug Bridge (ADB), which may provide an initial method for reducing the impact of the malware.