What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Yes. On 8 October 2026, Bitdefender published a technical report describing low-cost Android phones that arrived with malware already in their firmware, before the buyer switched them on for the first time. The campaign is called Midnight Mimosa. It affects some multi-brand devices built on MediaTek platforms. It does not show that every inexpensive Android phone, or every phone from any one manufacturer, is infected.
How this differs from ordinary app malware
Most Android malware arrives as an app. You install it, grant it permissions, and removing it is usually a matter of uninstalling the app or running a security scan. The Midnight Mimosa case is different because the malicious component is part of the phone’s operating environment. Bitdefender describes a platform-signed, persistent system application embedded in firmware. Because it is signed like a genuine system component and sits below the level where a typical user or app can reach, it is not an app you can remove from the home screen.
As an Amazon Associate I earn from qualifying purchases.
Bitdefender’s own summary of the problem is that the malware ships with the device. Its report adds: “What remains unclear is at which point in the supply chain it is integrated.”
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the hidden component does
According to the Bitdefender report, the persistent system application is the infection enabler. It can silently install and remove apps and grant permissions. It delivers a rotating family of at least 32 disguised payload applications. These are the reported count of payload apps identified by the researchers, not a count of infected phones.
#1 Best Overall
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
The payloads described in the report fall into three behaviours:
- Ad fraud: fabricated advertising impressions or clicks, which earn money for the operators without any real user interest.
- Silent app installation: installing other apps in the background.
- Residential proxyware: TCP proxy software that can enrol the device as a relay node, letting third parties route traffic through the owner’s home connection.
These are the capabilities and behaviours Bitdefender reports. The report does not establish that every affected handset was used for every purpose.
How many devices, and where
The Record, which reported on the same day and attributed its measurements to Bitdefender, said researchers observed the malware on thousands of devices across more than 150 countries over roughly two years. These are campaign observations, not an estimate of how many Android phones worldwide are affected.
Rank #2
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
- DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
- CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
- PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
- BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.
By reported share, Mexico, France and Italy had the largest concentrations, followed by the United States, Germany, Brazil and Spain. Treat that ranking as a description of where Bitdefender’s sensors saw the campaign, not as a measure of which markets sell the most infected phones.
Which phones are involved
Bitdefender identifies two model strings as its highest-volume examples: Doogee S200 X and Cubot KINGKONG X. Those names are associated with the campaign in the report, but they are not a complete list, and they are not a reliable test for an individual phone.
Two problems limit what a model name can tell you:
- Counterfeits: Bitdefender documents counterfeit phones that display the model names of more expensive brands. The report also found model strings mimicking Samsung and Apple products. A displayed name on a counterfeit device says nothing reliable about what the hardware actually is.
- Multiple firmware paths: the malware appears across different firmware and signing arrangements, so a single model name does not map cleanly onto a single firmware build.
The Record reports that some affected devices were sold through mainstream online marketplaces and cites one examined phone that cost about $180. That is a single reported example, not a verified price range, and it is not a threshold below which a phone is dangerous. Do not assume that a higher price keeps a phone clean.
Rank #3
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
Who is responsible: an open question
Some firmware in the campaign was signed with certificates bearing the name Shenzhen Zediel. Bitdefender’s researchers say explicitly that this alone does not show that Zediel created the malware, distributed it knowingly, or knew it was present. The malware could have been introduced by a device maker or original design manufacturer, a firmware integrator, a logistics partner, or another intermediary. The available evidence does not say which party did it.
Until a manufacturer or regulator publishes a finding on that question, the accurate position is that the supply chain is the open question, not any named company’s guilt.
What to do if you own one of these phones
The steps below follow the official advice from Finland’s NCSC-FI, published through Traficom, and the practical assessment in Android Authority’s explainer. They are written for an owner who suspects a phone is affected.
Rank #4
- PRIVACY DISPLAY: Automatically hide your screen from those beside you. The built-in privacy display can be preset¹ to turn on when receiving notifications, typing passwords, or using specific apps
- TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist² with Galaxy AI.³ Add objects, restore details, or apply new styles by simply typing or tapping
- NIGHTS, CAPTURED CLEARLY: From gigs to city lights, record and capture moments after dark with clarity using Nightography so your photos and videos stay crisp and clear on your Samsung Galaxy
- MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile phone, whether it’s a special contact photo, custom wallpaper, an invitation or more⁴
- HELP THAT KEEPS UP: Stay in the moment while Now Nudge with Galaxy AI helps you respond faster and stay organized with smart suggestions⁵ that appear exactly when you need them on your phone
- Find the model name and number. On most Android phones, open Settings and go to About phone. Menu labels vary by manufacturer, so search the settings for “model” if needed. Keep the model number, the purchase receipt and the seller’s name, since you will need them to make a claim.
- Compare the model against the report, but do not treat a match as proof. A match means the phone deserves a formal inquiry. A non-match does not mean the phone is clean, because the report is not a complete inventory.
- Ask the manufacturer or seller for an official, device-specific firmware remedy. Request a written answer on whether the model is affected and whether an official fix exists.
- If an official fix exists, install it only through the manufacturer’s official update channel. Do not install firmware images downloaded from forums or unofficial sites, since that is itself a way to introduce more untrusted code.
- If there is no official fix, disconnect the device from the network. NCSC-FI advises this when a manufacturer does not offer a patch. Then take the device to an electronic-waste collection point.
What will not reliably remove the malware
Traficom’s guidance says that when malware is embedded at a write-protected firmware level, a normal update or factory reset cannot remove it. For that reason, do not rely on any of the following to clear a persistent system component: a factory reset, a standard antivirus app, Google Play Protect, or a downloaded firmware image. These steps may still be worth doing for ordinary app-based threats, but they are not a fix for firmware-level persistence.
If you need a replacement
Android Authority’s consumer explainer describes replacement as the most viable option for ordinary users in this situation. That is its practical assessment, not a manufacturer guarantee. If you buy a replacement Android phone, look for these three things before you pay:
- Authorised sale: buy from the manufacturer or a retailer the manufacturer names as authorised, and confirm the device is genuine.
- Stated security-update support: check how long the manufacturer says it will provide security updates for that exact model.
- Official update access: confirm that the phone receives updates through the manufacturer’s official channel, not a third-party image.
No particular replacement handset, seller or program has been verified as clean by this report, and no one should read it as a recommendation for any model.
Best Value
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
- ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
- CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
- PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
- 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US
Earlier cases that are not the same campaign
Preinstalled Android malware is not new. TechCrunch’s 24 May 2018 report on Avast’s findings described a Cosiloon dropper placed in the system partition of some low-cost Android devices from ZTE, Archos and myPhone. That was a separate incident. Its existence does not show that those brands are affected by Midnight Mimosa today.
Traficom’s 2025 advisory, dated 4 August 2025, covers a different category: pre-infected Android smart devices, particularly TV boxes and home-network terminals found in the Finnish consumer market, including examples linked to BadBox 2.0. It is a useful parallel for the firmware risk, but it concerns different hardware, not the Midnight Mimosa phones.
What is established and what is not
- Established by Bitdefender’s report: a persistent, platform-signed system component embedded in firmware on some low-cost, multi-brand MediaTek devices; a rotating family of at least 32 disguised payloads; and reported ad-fraud, silent-install and proxyware behaviour.
- Reported by The Record, citing Bitdefender: observations across thousands of devices in more than 150 countries over roughly two years, with the country shares described above.
- Not established: whether all cheap Android phones are affected; whether any named manufacturer is responsible; which supply-chain party introduced the malware; and any validated way for an individual owner to confirm that a specific handset is infected.
Bitdefender’s researchers also put the broader concern in plain terms. Quoted by The Record, they said: “The internet is flooded with extremely cheap, and sometimes straight-up counterfeit, Android phones,” and “One way to make the money back on hardware sold that cheaply is to load it with software that earns afterwards.”
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
