Researchers at Bitdefender have uncovered a supply-chain attack targeting budget Android phones sold through online marketplaces. The campaign, called Midnight Mimosa, plants malicious code in device firmware before the phone ever reaches the buyer. The malware cannot be removed through standard factory resets or app management.
The findings expose a growing threat that most security guides ignore entirely: compromised hardware that leaves owners with no clean path forward.
What the Research Found
The investigation began when a system component flagged as com.android.system.lite started behaving oddly. The app ran with system-level privileges, lacked an icon, and didn't appear in the launcher. It repeatedly enabled Accessibility and Notification Access permissions, then silently installed and removed other applications without the owner's knowledge.
The component was platform-signed, meaning it came pre-installed and passed normal integrity checks. Its malicious code hid inside a native library that only activated at runtime, making static analysis ineffective.
The malware connects to a command-and-control server and pulls down further instructions. It can install or remove apps at will, grant permissions, and load additional code on demand. The operators behind the campaign used this flexibility to conduct ad fraud, click fraud, and to repurpose infected devices as proxy nodes in botnets.
Affected devices span more than 150 countries, with Mexico, France, Italy, the United States, Germany, Brazil, and Spain among the most reported. Two models appear most frequently among infected devices: the Doogee S200 X and the Cubot KINGKONG X. Many affected devices are counterfeits borrowing flagship names like "i17 Pro Max", "S25 Ultra", or "Note 18 Ultra" — devices that weren't made by Samsung but report the Galaxy S25 Ultra model code.
How the Ad Fraud Works
Once the enabler app is running, it installs a rotating set of at least 32 cover apps — weather tools, file managers, note takers, and OCR utilities. These apps carry legitimate advertising SDKs, which is what ad networks see and pay out for.
A hidden plugin then displays ads the owner never requested. These ads appear in windows that cover the screen or pop up when the device wakes, and they are marked as secure — a flag meant to prevent banking apps from appearing in screenshots. That design choice prevents owners from capturing evidence.
The permissions the malware grants itself include SMS access, giving operators the ability to read one-time codes and send texts to premium numbers. Bitdefender's researchers noted that the operators have a documented history of premium SMS subscription fraud.
Who Should Care
Budget phone buyers:** If you're comparing specs-to-price ratios on Amazon, AliExpress, or gray-market resellers, you're in the primary crosshairs. The economics of these devices often depend on revenue from ad fraud to stay profitable.
Refurbished phone shoppers:** Secondhand devices from these supply chains carry the same firmware risk. A clean reset doesn't fix a compromised device.
Business users:** Phones used for work accounts, banking, or any sensitive communications should be verified purchases from authorized channels. Infected devices expose credentials and communications.
Security professionals:** The 13 Google Play apps that shared code with this campaign passed Play review. This suggests the fraud operation has resources to bypass standard app store vetting.
Why This Matters
This campaign exploits a blind spot in how most people think about phone security. The assumption that malware comes from risky app downloads or phishing links misses the point entirely. Here, the phone is already compromised before you touch it.
The trade-off is uncomfortable: budget phones often depend on advertising revenue to offer low prices. Some manufacturers may be knowingly participating, while others may be victimized by component suppliers or firmware integrators. Distinguishing between the two is nearly impossible from the outside.
If firmware-level implants become a standard tool for threat actors, the entire model of mobile security — antivirus apps, permission prompts, app reviews — becomes insufficient. Your security app can't detect what it can't see, and what it sees looks like a system process.
What to Watch
Several developments will determine whether this threat grows or gets contained:
Brand response:** Affected manufacturers — Doogee and Cubot specifically — have not issued public statements. Their response, or silence, signals how seriously the industry takes firmware supply-chain accountability.
Play Store cleanup:** The 13 apps that passed review are still live or recently removed. Whether Google expands detection for shared infrastructure across apps will test the platform's resilience.
Regulatory attention:** Marketplace standards for device provenance don't currently exist in most markets. Whether this campaign draws policy attention depends on whether it spreads beyond niche budget devices into mainstream mid-range products.
Your own device list:** If you own a Doogee S200 X, Cubot KINGKONG X, or any budget phone with a flagship-impersonating model name purchased from an online marketplace, consider it at risk. There is no user-accessible way to verify firmware integrity.
Key takeaways
- Pre-installed firmware malware bypasses every security tool you can install after purchase
- Budget phones from online marketplaces carry higher supply-chain risk than most buyers realize
- The only reliable defense is buying from authorized retailers and known brands with verified sales channels
- Cover apps with legitimate ad SDKs are a revenue mechanism, not the primary threat
- Treat any device that can't be verified before purchase as potentially compromised
Frequently asked questions
Can I remove the malware by doing a factory reset?
No. The malicious code lives in the firmware, which a factory reset does not touch. The device remains compromised regardless of what you do after first boot.
How do I know if my phone is affected?
If you own a Doogee S200 X, Cubot KINGKONG X, or any budget phone with a flagship-impersonating model name purchased from an online marketplace, consider it at risk. There is no user-accessible way to verify firmware integrity.
Are flagship phones from major brands safe?
Generally yes, when purchased through official channels. The attack targets supply chains for budget and gray-market devices specifically.
What do the attackers gain from my infected phone?
Revenue through ad fraud, click fraud, residential proxy services sold to other threat actors, and potentially premium SMS charges. The botnet capability can also be rented for DDoS attacks.
Is there any way to detect this malware manually?
The malicious system app has no icon and hides from the launcher, so most users won't see it. Watching for unexpected ads, unusually fast battery drain, or data usage spikes may offer indirect clues, but there is no reliable manual detection method.