{"id":380721,"date":"2026-10-13T02:20:00","date_gmt":"2026-10-13T09:20:00","guid":{"rendered":"https:\/\/cms-articles.softonic.io\/en\/?p=380721"},"modified":"2026-10-21T05:26:49","modified_gmt":"2026-10-21T12:26:49","slug":"cheap-android-phones-ship-with-midnight-mimosa-firmware-malware-that-can-survive-a-factory-reset","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/cheap-android-phones-ship-with-midnight-mimosa-firmware-malware-that-can-survive-a-factory-reset\/","title":{"rendered":"Cheap Android phones ship with Midnight Mimosa: firmware malware that can survive a factory reset"},"content":{"rendered":"

Bitdefender<\/a> says a firmware-level Android<\/a> malware campaign called Midnight Mimosa has been lurking on cheap Android phones for the past two years<\/strong>, with MediaTek-based models showing up again and again in its report.<\/p>\n

\r\n
\r\n
\r\n
\r\n \"Bitdefender\r\n <\/div>\r\n
\r\n Bitdefender Mobile Security<\/span>\r\n Download<\/a>\r\n <\/div>\r\n
\r\n <\/path><\/path><\/text><\/svg>\r\n <\/div>\r\n <\/div>\r\n
\r\n <\/span>\r\n <\/div>\r\n
\r\n \r\n <\/div>\r\n <\/a>\r\n <\/div>\r\n<\/div>\n\n\n\n

At the center of it is a preinstalled component named com.android.system.lite. According to Bitdefender, that component gives attackers system privileges<\/strong> on the device, enough to quietly install or remove apps, grant permissions, run remote code, and get into accessibility services, notifications, and SMS. And because com.android.system.lite sits in the firmware, Bitdefender says a factory reset may not remove it. An antivirus scan<\/a> may not catch it either.<\/p>\n\n

Bitdefender also says the malware talks to command-and-control servers<\/strong> and pulls down payloads disguised as utility apps. It can disable the Google Play Store<\/a> too, which helps it slip past Play Protect. Most of the activity appears tied to ad fraud and residential proxy abuse, the kind of setup that can turn your phone into a relay node in a botnet.<\/p>\n\n

So if you’re eyeing a bargain Android handset, this is the part to pay attention to. Bitdefender says Midnight Mimosa has been active for two years<\/strong>, has hit thousands of devices in more than 150 countries, and shows up most heavily in Mexico, France, Italy, the US, and Germany. The company also found overlap with 13 Google Play apps that were using the same servers.<\/p>\n\n

You can read Bitdefender’s report for the full breakdown. In it, the company says the compromised firmware was signed with certificates<\/strong> attributed to Shenzhen Zediel Co., Ltd., though Shenzhen Zediel Co., Ltd.’s exact role is still unclear. Bitdefender adds that the campaign looks a lot like BadBox, which has appeared on unbranded, counterfeit, or very cheap phones sold through online marketplaces.<\/p>\n

\r\n
\r\n
\r\n
\r\n \"Malwarebytes\r\n <\/div>\r\n
\r\n Malwarebytes Anti-Malware<\/span>\r\n Download<\/a>\r\n <\/div>\r\n
\r\n <\/path><\/path><\/text><\/svg>\r\n <\/div>\r\n <\/div>\r\n
\r\n <\/span>\r\n <\/div>\r\n
\r\n \r\n <\/div>\r\n <\/a>\r\n <\/div>\r\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"

Bitdefender says a firmware-level Android malware campaign called Midnight Mimosa has been lurking on cheap Android phones for the past two years, with MediaTek-based models showing up again and again in its report. At the center of it is a preinstalled component named com.android.system.lite. According to Bitdefender, that component gives attackers system privileges on the … Continue reading “Cheap Android phones ship with Midnight Mimosa: firmware malware that can survive a factory reset”<\/span><\/a><\/p>\n","protected":false},"author":9349,"featured_media":380720,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[1015],"tags":[],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-380721","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t