Midnight Mimosa Malware Comes Preinstalled on Cheap Android Phones: How to Check Yours

The Midnight Mimosa malware is hiding inside the firmware of some cheap Android phones, so it’s already there when you take the phone out of the box. Security firm Bitdefender found it on thousands of devices in more than 150 countries. If you own a budget phone from a little-known brand, here’s how to check it and what to do next.

• Found by: Bitdefender, reported on October 8, 2026
• Where it lives: phone firmware, mostly low-cost MediaTek-based models
• Named examples: Doogee S200 X, Cubot KINGKONG X, and fake Samsung and Apple lookalikes
• What it does: runs ad fraud and can sign phones up to a proxy network
• Main risk: normal uninstalling doesn’t remove it

Most people with a Pixel, Galaxy or other mainstream phone aren’t affected. The risk sits at the bargain end of the market.

What is the Midnight Mimosa malware?

It’s a family of malware built into the phone’s system software, not a normal app you can delete. According to BleepingComputer, Bitdefender spotted it when a system app called com.android.system.lite kept quietly installing and removing other apps.

Because it runs with system-level privileges, it can install apps, grant permissions and run code downloaded from remote servers. You don’t have to tap anything.

Bitdefender counted about 32 apps in the framework, disguised as weather tools, file managers, app lockers and audio editors. The activity ran for roughly two years.

What does it actually do to your phone?

The main job is ad fraud. The hidden apps load ads in invisible windows and click them automatically, which earns money for the attackers and wastes your battery and data.

It also tries to dodge Google’s defenses. It briefly switches off the Google Play Store during silent installs, then turns it back on. eSecurity Planet notes researchers suspect this could get around app scanning, but that effect isn’t verified.

The scariest part is the proxy component. One app registers phones with a command server, which could let outsiders route traffic through your internet connection. Bitdefender confirmed the server accepted registrations, but it did not prove phones were actively relaying traffic.

Which phones are affected?

The table below shows what Bitdefender and the press reports have said so far. The list isn’t complete, and the manufacturers haven’t publicly explained how the code got in.

Why does firmware matter so much? Normal advice like “only install from Google Play” doesn’t help when the problem ships with the phone. Bitdefender also found 13 apps on Google Play with the same ad-fraud code. Those lack the power to install other apps silently, but they can still show ads outside their own screens.

Most victims were in Mexico, France, Italy, the United States, Germany, Brazil and Spain.

How can you check your phone for Midnight Mimosa?

There’s no official scanner yet, so the checks are manual. Here’s what to look for.

1. Open Settings, then Apps, and choose the option to show system apps.
2. Look for names like com.android.system.lite, com.android.sys.prot or com.android.sys.gmsprot.
3. Watch for apps that reinstall themselves after you delete them.
4. Notice ads that pop up outside any app, or battery and data use you can’t explain.

Finding one of those names is a strong warning sign. Not finding one doesn’t prove the phone is clean, since the reports list only a few package names.

What should you do if your phone looks infected?

Stop using it for banking, email and anything sensitive. Contact the seller or maker and ask for a clean firmware update.

Bitdefender says real removal needs a firmware-level cleanup, or disabling the bad component through Android Debug Bridge, which most people shouldn’t try alone. One Doogee owner reported that the malware vanished after rolling back firmware but returned when the official update was installed again. So updates aren’t a guaranteed fix either.

Buying from an authorized retailer lowers your risk, though it doesn’t remove it. Be wary of any phone sold with flagship specs at a tiny price, especially from a seller you don’t know.

Phone security news moves fast. Our post on the Samsung October 2026 security update shows what a normal patch cycle looks like on a mainstream phone, and the Galaxy S26 Pwn2Own story covers a very different kind of risk.

Frequently Asked Questions

Can antivirus remove Midnight Mimosa?

Probably not on its own. The core component sits in the system partition with elevated privileges, so ordinary uninstalling doesn’t work.

Does a factory reset fix it?

It’s unlikely to help on its own. Bitdefender says removal needs firmware-level cleanup, and a reset doesn’t change the firmware.

Is my Pixel or Galaxy phone at risk?

Nothing in the reports points to mainstream phones bought from authorized sellers. The named cases are low-cost brands and counterfeit clones.

Is Midnight Mimosa stealing my passwords?

The reports describe ad fraud and a possible proxy network, not password theft. But a phone with this much access could do more, so treat it as untrusted.

The practical verdict

If you bought a bargain phone from a brand you’d never heard of, check it today and don’t put banking apps on it until you’re sure. For your next phone, spend a little more and buy from an authorized seller, because a $60 saving isn’t worth a phone that works for someone else.