Budget Android Phones Ship With Hidden Firmware Proxy Malware

Low-cost Android smartphones sold globally on online marketplaces are shipping with sophisticated malware embedded directly into their factory firmware, according to an investigation published on October 8, 2026, by cybersecurity firm Bitdefender. Dubbed “Midnight Mimosa,” the campaign pre-installs system-level backdoors onto budget MediaTek-based handsets before consumers unpack them. The embedded packages enable automated ad fraud, download arbitrary software, and convert infected devices into residential proxy relay nodes without user consent. Over two years, telemetry tracked infections across more than 150 countries, targeting popular budget rugged models like the Doogee S200 X and Cubot KINGKONG X alongside unbranded clones mimicking flagship Samsung and Apple designs.

Firmware malware discovered on budget Android devices

Unlike conventional mobile trojans that depend on deceptive downloads or phishing links, Midnight Mimosa compromises devices during manufacturing or distribution. Bitdefender identified the threat after its on-device App Anomaly Detection flagged an anomalous system component registered as com.android.system.lite. While disguised as an integral operating system process, the package demonstrated behavior inconsistent with Android platform services, silently installing and deleting background applications while granting itself elevated permissions.

Further reverse engineering revealed that com.android.system.lite represents merely one build of an expansive malware framework. Analysts located identical functionality deployed under rotating system-sounding package names, including com.android.sys.prot, com.android.sys.gmsprot, and com.android.non.szcz. Because these packages reside inside the read-only system partition and run under the privileged android.uid.system user ID, standard Android application managers cannot uninstall them, and conventional factory resets fail to eradicate the root infection.

How Midnight Mimosa operates and evades detection

The operational framework of Midnight Mimosa separates system-level privilege brokers from outward-facing monetization modules. The primary system package acts as an enabler, embedding a native library designated libeasy.so. Upon system boot, this library decrypts a hidden Java framework that connects to command-and-control (C2) servers hosted at api.weatherlive.world to download secondary modules disguised as image files.

The malware deploys a multi-stage monetization model using dropped applications and residential proxy tunnels:

To avoid security alerts, the enabler exploits its platform privileges to execute pm disable com.android.vending, temporarily shutting down the Google Play Store and blinding Google Play Protect immediately before deploying a payload. Once installation completes, it re-enables the store service. The enabler also fakes application provenance, recording Google Play as the installing entity on packages that lack Google’s authentic server-side cryptographic signature block.

Beyond ad fraud executed through dropped utilities like weather apps and note keepers, the malware bundles a specialized proxy client named EnLoaderLib within a decoy app locker. Once active, the node registers device hardware specifications with remote controllers, establishing full-duplex TCP tunnels. Attackers can route arbitrary internet traffic through the phone’s consumer IP address, masking malicious traffic or probing private home networks.

Affected models and supply chain origins

Telemetry indicates the infection footprint spans thousands of active endpoints worldwide. While detections appeared in over 150 nations, the highest volume concentrated in Mexico, France, Italy, the United States, Germany, Brazil, and Spain. This geographic profile reflects global e-commerce distribution patterns rather than regional telecom carrier shipments.

Hardware analysis indicates that the campaign concentrates entirely on low-cost devices powered by MediaTek chipsets. Researchers observed two distinct categories of impacted hardware:

• Legitimate budget brands: High-volume rugged models including the Cubot KINGKONG X, Doogee S200 X, and Doogee Fire 3 Max. Community members on XDA Forums previously reported persistent system packages that reappeared after manual removal or were introduced via over-the-air firmware updates.
• Counterfeit flagship clones: Unbranded devices using spoofed build strings to impersonate premium devices, including counterfeit iPhone models (“i17 Pro Max”, “i16_Pro_Max”) and Samsung Galaxy clones reporting strings like “S25 Ultra” and “SM-S938B”.

Platform certificates on multiple affected devices tied back to Shenzhen Zediel Co., Ltd., a Chinese original equipment manufacturer. However, Bitdefender emphasized that technical certificate attribution does not establish that the vendor authored the malware. In complex hardware distribution channels, unauthorized modifications can occur at original design manufacturers (ODMs), third-party firmware integrators, or freight consolidators. While research into software-level analysis continues across the industry—such as how GitHub’s AI security agent found 24 Android flaws in platform components—firmware tampering bypasses standard application vetting before software reaches consumers.

Additionally, Bitdefender confirmed that 13 ad fraud applications connected to the same infrastructure had successfully penetrated the official Google Play Store under developer accounts including fivedev and CPS Developer, demonstrating that the threat operators maintain redundant distribution channels.

What happens next

Mitigating firmware-level infections presents steep technical hurdles for everyday consumers. Because the root enabler is embedded into the read-only operating system partitions, standard software removal procedures are ineffective. Device owners seeking to sanitize affected hardware must pursue specialized intervention:

• Disabling packages via ADB: Users with technical experience can connect their smartphone to a computer and execute Android Debug Bridge commands (such as pm disable-user --user 0 <package_name>) to deactivate malicious system packages like com.android.system.lite.
• Installing clean firmware: Resolving the infection permanently requires flashing verified, clean stock ROM images provided directly by the hardware manufacturer. While some manufacturers have issued corrective over-the-air firmware updates, other budget vendors have not yet addressed the vulnerability publicly.
• Isolating untrusted devices: Owners of heavily discounted or counterfeit smartphones who detect persistent pop-up ads, unusual data consumption, or rapid battery drain should refrain from conducting sensitive financial transactions or storing confidential credentials on those endpoints.

Online marketplaces and mobile hardware vendors face mounting pressure to implement strict cryptographic validation and tamper detection across overseas device supply chains to prevent pre-compromised hardware from reaching retail buyers.