Low-cost Android phones ship with residential proxy malware

A malware campaign dubbed Midnight Mimosa has been found on low-cost Android phones with MediaTek chipsets. The malicious software is embedded in device firmware and can silently install apps, commit advertising fraud, and turn phones into residential proxies.

Bitdefender researchers said the campaign affected thousands of devices in more than 150 countries over approximately two years. The highest numbers of victims were in Mexico, France, Italy, the United States, Germany, Brazil, and Spain. Affected devices included models associated with legitimate manufacturers, such as the Doogee S200 X and Cubot KINGKONG X, as well as phones impersonating Samsung and Apple products.

The malware has system-level privileges, allowing it to install or remove apps, grant sensitive permissions, and run code downloaded remotely without user interaction. Researchers identified approximately 32 apps distributed through its framework, disguised as tools including weather utilities, file managers, app lockers, OCR tools, and audio editors. Bitdefender said the apps load legitimate ads in an invisible window to generate fraudulent impressions and clicks.

Some malware components can also register infected devices with a remote command server and relay network traffic through them. Bitdefender confirmed that this proxy infrastructure was operational and accepting registrations. However, researchers said their test device did not receive relay targets, so they could not confirm whether attackers were actively forwarding traffic.

The malware’s introduction into the firmware supply chain, including who was responsible and when tampering occurred, remains unclear. Some users said manufacturers released firmware updates that resolved infections, but manufacturers had not publicly explained how the malicious software entered the affected firmware.