Midnight Mimosa: pre-installed Android malware on Doogee and Cubot phones silently installs 32 apps, commits ad fraud and turns devices into proxies

The owners did nothing wrong — no shady apps installed, no suspicious links clicked — yet the malware was already sitting inside the system software when the phone left the factory. That is the essence of Midnight Mimosa, the large-scale Android malware campaign disclosed on October 8 by Bitdefender researchers Adrian Mihai Gozob and Alex Baciu: thousands of devices in more than 150 countries, mostly cheap rugged phones from Doogee and Cubot, shipped with a system-privileged malicious component that silently installed 32 more apps, committed ad fraud and prepared to turn each handset into a proxy node over roughly two years.

Quick answer

• Midnight Mimosa is a firmware-level, pre-installed Android malware campaign disclosed by Bitdefender on October 8; the initially detected component used the package name com.android.system.lite, posing as a core Android component while holding system privileges.
• Scale, per Bitdefender: thousands of devices across more than 150 countries over about two years; Mexico, France and Italy recorded the most affected devices; the two most common models are the Doogee S200 X and the Cubot KINGKONG X, both MediaTek-based rugged phones.
• The malware installs and removes at least 32 rotating apps (weather, lock screen, file manager, icon maker, text extraction, audio editing and similar utilities); before each install it disables the Google Play Store to evade Play Protect and re-enables it afterwards, and some variants fake the install source as Google Play.
• The main revenue stream is ad fraud: the malware displays full-screen ads by itself, clicks them automatically, records a fake conversion about a minute later, and uses Android's FLAG_SECURE to block screenshots; it can also register the phone into a proxy network via a hidden app called Locket.
• It grants itself dangerous permissions — Accessibility, notification access, SMS read/write — and collects the IMEI, Android ID, MAC address and the list of installed apps; per Bitdefender these permissions were staged but the report records no actual use of them.
• Practical remediation: install the manufacturer's latest cleaned firmware update (both Cubot and Doogee have shipped fixes, according to user reports), check for suspicious packages with ADB and disable them if needed; a factory reset is not enough because the malware lives in the firmware.

What is Midnight Mimosa and how does it work?

Midnight Mimosa is Bitdefender's name for a malware campaign pre-installed in the system software of certain Android phones before they reached buyers. Bitdefender's security systems first flagged an application named com.android.system.lite — outwardly indistinguishable from a core Android component. Behavioral analysis showed it silently installing and removing other software without the owner's consent.

Because it is integrated into the system software, the component does not behave like an ordinary app: it can install and uninstall applications, grant permissions to itself and execute code downloaded from a remote command-and-control server. It carries a name resembling an official component, holds system privileges and offers no normal uninstall option — the owner only has to unbox the phone, power it on, choose a language and sign in to a Google account for the malware to start working.

Beyond the two most prevalent models, the Doogee S200 X and Cubot KINGKONG X, researchers also recorded devices identifying themselves as S25 Ultra, S26 Ultra, Note 18 Ultra or i17 Pro Max; some handsets even reported model codes matching real Samsung products that Samsung never manufactured — a hallmark of counterfeit-brand devices.

How do the 32 rotating apps and the ad fraud work?

According to Bitdefender's count, the malware rotates through at least 32 different apps installed onto the phone. They are disguised as familiar utilities: weather apps, lock screens, file managers, icon creators, image-to-text extractors and audio editors. Notably, the lock-screen apps have no icon on the home screen, so users can hardly tell they exist.

One striking detail is how the malware deals with Google Play Protect: immediately before installing each new app, it disables the Google Play Store — researchers believe the purpose is to stop Android's protection system from vetting the incoming app. Once installation finishes (whether it succeeded or failed), the Play Store is switched back on. Some variants also spoof the installation source so the app information shows Google Play as the provider, making users believe they downloaded the app from the official store themselves.

The reason for dozens of apps is advertising money. The malware can display full-screen ads or overlay them on whatever is on screen, then click the ads automatically with no action from the owner. About a minute after an ad appears, it records a conversion event, making the ad system believe a real person interacted with the content. These ad screens use Android's FLAG_SECURE mechanism to block screenshots and screen recording, which makes observing the activity harder.

Can your phone be turned into a proxy server?

Yes — at least as a capability. A hidden app named Locket, in reality an icon-less lock-screen app, is designed to register the device into a proxy network. Other people's Internet traffic can then be routed through this phone's connection; the receiving website sees the device owner's connection instead of the actual requester, and such network resources can be sold to third parties.

One distinction matters, though: according to Bitdefender, their test phone did register a connection, but the server it communicated with was in fact a sinkhole — a controlled server used to collect and track malicious traffic. No real Internet traffic was relayed through the phone in that test.

Which dangerous permissions were staged?

The malware's capabilities are more concerning than what was directly observed. It grants itself Accessibility permission — allowing it to read on-screen content and perform taps on the user's behalf — and can access notifications and read and write SMS messages. That is especially dangerous because notifications often contain OTP codes and sign-in verification codes: if exploited, these permissions could support account takeover. The malware also collects the IMEI, Android ID, MAC address, SIM country code, time zone, phone model, Android version and the list of apps the user has installed.

Per Bitdefender, these accesses were prepared for follow-on activity, but the report does not record them being used in practice; notably, the Accessibility and notification-access permissions were repeatedly toggled on and off. In other words, the observed harm is mainly ad fraud and unauthorized app installation — while the toolkit for deeper attacks sat ready but unused.

How did users discover it?

Interestingly, users spotted the anomalies before Bitdefender's disclosure. On July 2, 2026, a Cubot KINGKONG X owner running Android 16 posted on the XDA forum about the app com.android.sys.extplv: antivirus software kept flagging it, the app called itself System, demanded access to messages, contacts and accounts — and Android showed Google Play as its install source. Within a week, many other users reported the same situation on Doogee and Cubot phones in the same thread.

One Doogee Fire 3 Ultra owner found the malware could hide itself: when USB Debugging was enabled and the phone connected to a computer, the app almost immediately disappeared; unplug the cable and it reappeared a few hours later. Removal did not solve the problem either: disabling it via ADB lasted only two days before it reactivated itself, and even a factory reset could not stop it coming back — consistent with malware residing in the firmware.

A more severe case was recounted by a Cubot user on August 4: their Telegram account was taken over (the attacker enabled two-factor authentication, changed the linked email and tried to move WhatsApp to another device), and the phone bill showed the device had sent about 30 SMS messages to domestic numbers on its own starting July 25, at random times. It must be stressed that this is a single individual's account, not independently verified — although its details fit the permissions the malware can grant itself.

Did the malware also arrive via the manufacturer's own firmware update?

Remarkably, some phones were infected not through downloaded apps but through the manufacturer's own software update. A Doogee Fire 3 Max owner traced the infected firmware version: the update DOOGEE-Fire 3 Max-EEA-Android15.0-20260616, 373 MB in size, released June 15, 2026 from the server fota5p.adups.com. In that build, the malware operated under the name Android System with the package com.android.non.szcz; as of August 5, the user reported the update was still being served online.

On the vendor side, Cubot explained to a customer by email in July that a development interface meant only for engineering testing had accidentally been included in mass-production firmware; the company said the firmware had been cleaned and had passed Google's security certification. What Bitdefender found, however — dozens of rotating apps, ad fraud, proxy capability and Play Protect evasion — is hard to reconcile with a mere leftover test interface.

After the campaign was disclosed, Cubot released updates for the KingKong 9 and KingKong X in July, and users reported the malicious app had disappeared. Doogee likewise announced a fix via software update; a firmware build released July 31, 2026 for the Fire 3 Max was checked by a user and found clean, remaining so at least until August 24.

So who put the malware into the phones? The answer is still unclear. Firmware on some affected devices was signed with a certificate researchers traced to Shenzhen Zediel Co., Ltd. — but that does not prove the company wrote the malware or knew of its existence; the malware also appeared on phones not using the related firmware. It could have been introduced at the assembly factory, by the firmware developer, by a software supply partner or at another link in the supply chain. The campaign's command infrastructure also has a history: two servers previously appeared in Dr.Web data tied to an ad-fraud trojan from late 2025 (hidden in Minecraft- and GTA-style game clones distributed through Xiaomi's app store, clean at first, then weaponized via updates), and the campaign also used a domain previously seen in the Joker malware's 2021 activity.

Is the same ad-fraud code also in 13 Google Play apps?

The problem does not stop at pre-infected phones. Bitdefender also found the same ad-fraud code in 13 apps on Google Play. Those apps lack the system privileges of the firmware-integrated variant, but they communicate with the same malicious servers. As of a check on October 10 cited in the original post, all 13 apps were still on Google Play with a combined minimum of over 1.4 million downloads; Daily Weather alone exceeded one million downloads.

The 13 flagged apps are: Daily Weather, CoolWeather, WeatherGo, Lock & Hide, All Deleted Messages Recovery, App Icon DIY, Audify, Wavrge, QuickText Extractor, NoteMaster, QR Pocket, Tap to Translate and Tasky. If any of them is on your phone, uninstall it.

Aspect	Pre-installed firmware variant	Variant in the 13 Google Play apps
Entry route	Built into system software from the factory, or delivered via a firmware update	Downloaded by the user from Google Play
Privileges	System level: install/remove apps, self-grant permissions, run remotely downloaded code	Ordinary app permissions, no system privileges
Removability	No normal uninstall; factory reset is not fully effective	Uninstalls like a normal app
Malicious activity	Installs 32 rotating apps, ad fraud, proxy registration, staged Accessibility/SMS permissions	Contains the same ad-fraud code, contacts the same command servers

Is this the first time malware shipped inside factory software?

No. Midnight Mimosa is the latest link in a long chain of Android supply-chain malware cases:

When	Case	Disclosed/warned by	Key facts
November 2016	BLU R1 HD shipped with updater software from Shanghai Adups Technology	Kryptowire	Factory software could send message content, contacts, call history, IMSI and IMEI to a server in Shanghai; could install apps remotely
April 2025	Triada trojan embedded in firmware of counterfeit-brand phones	Kaspersky	More than 4,500 devices affected; over USD 264,000 in cryptocurrency stolen
June 2025	BADBOX 2.0	FBI	Millions of TV boxes, projectors, car displays and digital photo frames infected before purchase or during setup, then rented out as proxy nodes
February 2026	Keenadu backdoor in Android tablet firmware	Kaspersky	Some devices received infected firmware through an update bearing a valid digital signature
2026	Midnight Mimosa on Doogee, Cubot and counterfeit phones	Bitdefender	Pre-installed in firmware, 32 rotating apps, ad fraud, proxy capability

How do you check for it and clean your phone?

First step: install the manufacturer's latest software update before checking — both Cubot and Doogee have released cleaned firmware for the affected models, according to user reports. Then use ADB to look for suspicious packages with this command:

adb shell "pm list packages | grep -E 'system.lite|sys.prot|sys.gmsprot|sys.bcprot|sys.dts|sys.extplv|weiapps|weapps|non.szcz|com.mobile.applock'"

If a suspicious package is found, you can try disabling it (replace the package name in the command with the one actually detected on your device):

adb shell pm disable-user --user 0 com.android.sys.extplv

Understand the limits of this approach: disabling via ADB does not guarantee complete removal — some variants hide when they detect a USB connection and reactivate after some time, and a factory reset does not help if the firmware still contains the malicious component. According to the researchers, thorough cleaning requires addressing the firmware layer or disabling the malicious component via ADB; for most users, the practical solution is installing the official cleaned firmware, or replacing the device if the malware keeps coming back.

If you use Pi-hole or a router with domain blocking, you can block two addresses identified in the campaign: api.weatherlive.world (the server receiving commands and ad-fraud activity reports) and oss.showtimetool.com (the server supplying the malware's modules).

Frequently asked questions

Is my phone among the affected devices?

Per Bitdefender, the most-recorded models are the Doogee S200 X and Cubot KINGKONG X — cheap MediaTek-based rugged phones — along with counterfeit handsets identifying as S25 Ultra, S26 Ultra, Note 18 Ultra or i17 Pro Max, and devices that received firmware via the fota5p.adups.com server such as the Doogee Fire 3 Max. The surest route is to update to the latest firmware and then check packages with the ADB command in this article.

I never installed any strange app — how did I get infected?

With Midnight Mimosa, the malware does not come from an app you installed; it is embedded in the system software from the factory, or was delivered through a manufacturer's firmware update. It holds system privileges, has no normal uninstall button and can install further software without your consent — ordinary safe habits like not clicking suspicious links cannot prevent this kind of infection.

Does a factory reset remove the malware?

Not necessarily. A Doogee Fire 3 Ultra user recorded the malware returning after a factory reset and reactivating two days after being disabled via ADB — because the malicious component lives in the firmware, which a reset does not erase. The thorough fix is installing official firmware that the manufacturer has cleaned.

Has the malware actually stolen accounts or money?

According to Bitdefender's report, the activity actually observed is mainly ad fraud and unauthorized app installation; the dangerous permissions — Accessibility, notification and SMS access — were staged but not recorded in use. The Cubot user who described a hijacked Telegram account and about 30 self-sent SMS messages is an individual, independently unverified account. In the proxy test, Bitdefender's device connected to a sinkhole, so no real traffic was relayed.

Is Shenzhen Zediel the culprit behind Midnight Mimosa?

That cannot be concluded. Researchers traced the signing certificate of firmware on some affected devices to Shenzhen Zediel Co., Ltd., but that signature does not prove the company wrote the malware or knew about it; the malware also appeared on phones not using the related firmware. The insertion point could be any link in the supply chain — the assembly factory, the firmware developer or a software partner.

Conclusion

For years, Android users have been advised not to install apps from unknown sources, not to tap suspicious links and to check their phones regularly. Midnight Mimosa poses a completely different problem: when the malware is already inside the firmware before the device is sold, there is almost nothing the user did wrong to avoid. A phone can be factory-sealed, carry software certification, include Google Play and run a seemingly normal Android build, yet still contain a system-privileged malicious component. The practical lessons: for cheap phones from little-known brands — counterfeits of flagship models especially — prioritize the latest official firmware updates, periodically check for strange packages with ADB, and think carefully before using such a device for important accounts like banking or primary email. In this case, users did not install the malware by mistake — they bought a phone that had it from the very beginning.

Source: an introduction and compilation by the Hoc lap trinh cho nguoi moi bat dau page on Facebook (7 Nov 2026), based on material from Bitdefender Labs, XDA Developers, Dr.Web, Kryptowire, Kaspersky and the FBI; edited and structured by Wotech Electronics. Individual user accounts (such as the Telegram hijacking story) are personal experiences that have not been independently verified.