Midnight Mimosa: proxy and ad fraud in budget Android firmware

Bitdefender has published its analysis of Midnight Mimosa, a malware campaign that does not ask the user to install anything: the malicious code is already in the firmware of budget Android smartphones built on MediaTek chips, in the system partition, when the phone comes out of the box. Infected devices are used for ad fraud and can become remotely controlled residential proxies.

The story was covered by BleepingComputer, SecurityWeek and Cybersecurity360. All three rely on the Bitdefender report; BleepingComputer adds reports from users of the XDA forum.

What happened

According to Bitdefender, over roughly two years the malware appeared on thousands of devices in more than 150 countries. Most detections are in Mexico, France and Italy, followed by the United States, Germany, Brazil and Spain; SecurityWeek notes that, by region, Western Europe and the Americas stand out.

The models cited by BleepingComputer include the Doogee S200 X and Cubot KINGKONG X, as well as phones imitating Samsung and Apple products. On the XDA forum, a Doogee Fire 3 Max owner reports that the malware arrived with an official firmware update, disappeared after rolling back to the previous version and came back with the update. For some users, later updates from the manufacturers fixed the problem, but the manufacturers have not explained how the code ended up in the firmware.

It is not known who modified the firmware or at which point of the supply chain: Cybersecurity360 mentions an ODM manufacturer, a firmware integrator or a logistics intermediary as possibilities. Bitdefender found firmware signed with certificates linked to Shenzhen Zediel, stressing that this does not prove the company was involved.

Technical details

The system component. The core is a platform-signed system app posing as a legitimate Android package: com.android.system.lite, later also seen as com.android.sys.prot and com.android.sys.gmsprot (and, according to Cybersecurity360, com.android.sys.bcprot). With system privileges it installs and removes apps, grants permissions and runs code downloaded from the command-and-control server, without user interaction. It cannot be removed through the normal uninstall process. Bitdefender also links the com.android.non.szcz package reported on XDA to the same family.

The modules. About 32 apps arrive from the C2, disguised as weather apps, file managers, app lockers, OCR tools and audio editors. According to Cybersecurity360, the payloads change over time, so they stay on the device only briefly.

Evading controls. Before installing a payload, the malware temporarily disables the Play Store (com.android.vending), so that Google Play Protect is off during the installation, and then re-enables it. According to BleepingComputer, some variants also fake the recorded installer, so the apps appear to come from Google Play.

Ad fraud. The clicks are not generated by the system app but by the cover apps: they load real ads through a legitimate advertising SDK, show them in invisible windows on top of other apps or click them automatically, even when the phone is idle.

Residential proxy. An app disguised as an app locker, com.mobile.applock.en, contains a TCP proxy that registers the device with a remote server and receives orders to connect to specified hosts and forward traffic. The operator can thus route its own traffic through the victim’s connection or reach devices accessible from the phone. Bitdefender confirmed that the infrastructure was accepting registrations, but its test device received no relay targets: actual traffic forwarding is not confirmed. Only Cybersecurity360 mentions possible use for DDoS attacks.

On Google Play too. Bitdefender found 13 apps on Google Play with the same fraud code and the same infrastructure; according to BleepingComputer they are signed with 13 different certificates and published by at least two accounts, fivedev and CPS Developer. They cannot install software silently, but they show ads outside their own interface.

Public indicators. The package names are listed below; hashes and server addresses are in the Bitdefender report.

MITRE ATT&CK for Mobile (mapping based on the reported facts): T1474.003 (Supply Chain Compromise: Compromise Software Supply Chain), T1655.001 (Masquerading: Match Legitimate Name or Location), T1407 (Download New Code at Runtime), T1629.003 (Impair Defenses: Disable or Modify Tools), T1643 (Generate Traffic from Victim), T1604 (Proxy Through Victim).

Impact for European and Italian companies

Italy is among the three countries with the most detections. For a company the risk is not limited to an employee’s personal phone: budget smartphones are bought for warehouses, field teams, shift work or as service phones, and they connect to the corporate Wi-Fi. A device acting as a proxy brings strangers’ traffic into your connection: your IP address may show up in the logs of attacks against third parties and, if the phone is on the internal network, the operator can reach whatever the phone can see.

The case also shows that good user habits are not enough: avoiding suspicious APKs and using only the Play Store do not help if the phone arrives already compromised. For NIS2 entities, Article 21 requires supply chain security and security in the acquisition of systems: mobile devices fall within that scope.

What to do now

1. Inventory the Android phones owned by the company and those allowed on the network, with brand, model and firmware version; check budget models with MediaTek chips and those named in the sources first.
2. Look for the known packages with ADB or your device management system: com.android.system.lite, com.android.sys.prot, com.android.sys.gmsprot, com.android.sys.bcprot, com.android.non.szcz, com.mobile.applock.en.
3. On affected phones, Bitdefender points to two options: clean firmware or disabling the component via ADB (for example pm disable-user --user 0 <package>). A factory reset does not touch the system partition. If the manufacturer does not provide clean firmware, consider retiring the device.
4. Keep unmanaged devices separate: guest network or dedicated VLAN, with no access to servers and internal networks.
5. Check outbound traffic from the phone segments and compare it with Bitdefender’s indicators of compromise; a phone with persistent connections to unknown hosts or unusual volumes should be examined.
6. Signs on the device: apps that reinstall themselves after removal, a disabled Play Store, apps “from Google Play” that nobody downloaded.
7. When purchasing, choose devices certified for Play Protect and with guaranteed security updates.

How ARXDOME helps

No agent is installed on phones: visibility comes from the network. ARX Watch finds devices without a probe through DHCP requests and neighbour tables, and alerts you when a new or unauthorised device appears on the corporate network. ARX Sentry brings firewall logs into the SOC pages and the NOC map, with blocked outbound traffic and sources found on threat lists. With ARX Horizon you can search the published indicators of compromise from the portal.

Last updated: 9 October 2026