Bitdefender has identified an Android malware campaign called Midnight Mimosa that arrives on compromised phones already embedded in their firmware. The malware was detected on thousands of devices across more than 150 countries, meaning users can be exposed before opening a suspicious link or installing an app.
Tracked for roughly two years, the campaign has been seen most often in Mexico, France and Italy, followed by the US, Germany, Brazil and Spain. Because its core component is built into the firmware, it cannot be removed through a conventional app uninstall.
The hidden component can install or remove apps, grant permissions and download remotely controlled software. Bitdefender identified at least 32 cover apps, including weather utilities, file managers, OCR tools and audio editors. Those apps can generate fraudulent ad views and clicks or turn a phone into a residential proxy that relays other users' traffic. Midnight Mimosa can also temporarily disable the Google Play Store while installing additional components, in an apparent effort to evade Play Protect.
Device names in the telemetry
The researchers highlighted several genuine Android model names in their telemetry, although their presence does not mean every unit of a named model is infected:
- DOOGEE S200X, reported in telemetry as “S200 X”
- CUBOT KingKong X
- DOOGEE Fire 3 Max, which appears in Bitdefender’s chart as “Fire3Max”
Other affected devices had no identifiable consumer brand and instead used firmware identifiers rather than complete retail model names:
- J10_EEA
- A9_EEA
- T13_EEA
- Q6_EEA
The campaign also includes counterfeit phones using names designed to resemble established Samsung, Apple and HONOR products. The recorded identities include:
- “S24 Ultra”
- “S25 Ultra”
- “S26 Ultra”
- “Note 18 Ultra”
- “i17 Pro Max”
- “i16_Pro_Max”
- “17_Pro_Max”
- “iPadAirPro”
- “Magic 15 MAX”
Some counterfeit devices even report legitimate-looking model codes, including “SM-S938B,” which is associated with the Galaxy S25 Ultra. The clone names and spoofed identifiers are not evidence that original Samsung, Apple or HONOR products are infected, but they underline how firmware-level malware can be concealed behind both obscure hardware labels and familiar branding.
