Some cheap Android phones are compromised before they leave the box. Researchers at Bitdefender have documented a campaign they call Midnight Mimosa, in which malware ships preinstalled in the firmware of low-cost, multi-brand Android devices built on MediaTek chips. It runs with system-level privileges, starts before the owner has done anything, and cannot be uninstalled.
In Bitdefender's report, Silviu Stahie lays out what that access allows: the operators can silently install and remove apps, grant permissions to other apps, and load new code from a remote server whenever they choose.
A fake system component with real system powers
The first package Bitdefender found was named com.android.system.lite, labelled simply "System" with its icon hidden. It is platform-signed and runs as the system user, which is what lets it install and delete software and grant permissions without any prompt. Its real machinery hides in a native library that decrypts and loads a concealed framework at runtime, then pulls further plugins from a command server disguised as a weather API.
The same core turned up under other system-sounding names, including com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot, across different builds and signing certificates. As Bitdefender puts it, the package name is not the threat; the shared core underneath is.
How the phones earn money for someone else
The scheme is built for revenue. The system app quietly installs a rotating set of at least 32 disguised payload apps, such as fake app lockers, weather tools, note and OCR apps, and repeatedly removes and reinstalls them, which keeps any one of them out of sight and rotates file hashes. Those payloads load genuine ads through a legitimate ad SDK and fabricate impressions and clicks, using invisible overlays and screens flagged so they do not show up in screenshots or recordings. Other payloads turn the phone into a residential-proxy relay node, renting out the owner's connection, and Bitdefender warns that such botnets are also sold for DDoS attacks. The malware even disables the Google Play Store app just before installing a payload and re-enables it afterwards, likely to dodge Play Protect.
Bitdefender also found 13 apps on Google Play talking to the same servers, spread across at least two developer accounts. They lack the system privileges of the firmware packages but share the ad-fraud code.
The worrying part is what has not happened yet
The enabler grants itself Accessibility and Notification Access and holds SMS permissions. Bitdefender did not see these used, but stresses they are present, self-enabled and remotely armable. Those are the same powers Android banking trojans abuse to read screens and intercept one-time codes, as with the RemControl dropper that cut off Play Protect. Whether they get used is the operator's decision at the server, not a property of the code.
Where the malware enters the supply chain is unclear. Bitdefender confirmed that firmware on affected devices was signed with certificates bearing the name Shenzhen Zediel, but says it cannot say whether the certificate owner was involved, and it found infected phones without that firmware too. Counterfeit "flagship" models sold on mainstream marketplaces appear in its data. It is the same playbook seen when car head units became proxy bots through their own updater.
No uninstall button, so treat the device as untrusted
Because the malicious package is part of the firmware, ordinary users cannot remove it. Be wary of unusually cheap phones and of budget "flagship" lookalikes from unknown sellers, and do not use such a device for banking, work accounts or two-factor codes. Organizations that allow personal devices should consider flagging unknown MediaTek models and the package names above. Network defenders can block weatherlive[.]world, the domain Bitdefender found receiving the malware's fraud reports.
A phone that costs almost nothing has to make its money somewhere, and in this case the buyer is the product.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.