Bitdefender Uncovers Midnight Mimosa Campaign with Malware in Android Device Firmware
Bitdefender described the Midnight Mimosa campaign, involving malware embedded in the firmware of some low-cost, multi-brand Android devices using the MediaTek platform.
Bitdefender described the Midnight Mimosa campaign in a technical analysis on October 8, 2026. According to researchers, the malware is located directly in the firmware of some low-cost, multi-brand Android devices built on the MediaTek platform. This means the problem may reach a phone before it is turned on for the first time, rather than only after the user installs a risky app.
At the core of the campaign is a persistent system application with system-level permissions. According to Bitdefender, these allow it to silently install and remove apps, grant them permissions, and load remote code. Researchers identified at least 32 additional apps disguised so that their activity was not immediately apparent.
What the Midnight Mimosa Campaign Can Do
Bitdefender primarily links the campaign to advertising and click fraud. Infected devices may automatically generate ad interactions intended to generate revenue for operators. The discovered code also includes a component designed to abuse phones as residential proxy nodes.
A residential proxy node can route network traffic through an ordinary user’s connection. This function may allow a remote operator to use a compromised phone’s connection as part of proxy infrastructure. Bitdefender says it observed the activity for approximately two years on thousands of devices in more than 150 countries.
Its placement in system firmware is what distinguishes this case from ordinary malware in user applications. Security practices such as carefully downloading apps may therefore fail to detect the problem. Standard uninstallation of a suspicious app is not enough either, since the core of the infection remains a system component of the device.
Removal Is Not Simple
According to Bitdefender, known remediation options include modifying the firmware or disabling the relevant component through ADB, the Android Debug Bridge tool. For most phone owners, however, this is not a routine procedure. No universal firmware fix or official patch from manufacturers covering all potentially affected devices has been publicly confirmed.
Based on the available findings, the risk primarily concerns very low-cost, white-label, and counterfeit Android phones. However, Bitdefender does not say that the problem affects every low-cost device with a MediaTek chip. Model identifiers associated with the Doogee and Cubot brands alone also do not prove that all devices from these brands are infected.
Unclear Origin in the Supply Chain
The case represents a supply-chain compromise, but it has not yet been confirmed who inserted the malware into the chain or at what stage this happened. Certificates attributed to Shenzhen Zediel appeared in some of the examined firmware. Bitdefender also does not state that this finding proves the company created or distributed the malware, or knew about it.
Bitdefender also linked 13 apps to shared infrastructure. It remains to be seen whether Google will remove or flag them, and whether manufacturers, sellers, and online marketplaces will publish statements or firmware fixes. Independent confirmation of the scope of affected models and clarification of where the malware entered the supply chain will also be important.
Sources
- Bitdefender Labs – Primary technical analysis of the campaign, its capabilities, the scope of observations, indicators, and remediation options.
- BleepingComputer – Independently summarizes Bitdefender’s findings, highlights the unexplained point of infection in the supply chain, and describes the proxy function.
- The Record – Corroborates the campaign’s scope and the advertising fraud, while noting that attribution has not been confirmed.
Verified and updated: 10/09/2026 15:28
