Midnight Mimosa Android malware is a firmware-resident threat found on some low-cost Android devices using MediaTek platforms. Bitdefender disclosed the campaign on October 8, 2026, after telemetry linked it to thousands of devices across more than 150 countries. Because the core component is a privileged system app, uninstalling suspicious apps or performing a factory reset may not remove it.
What is Midnight Mimosa Android malware?
Midnight Mimosa Android malware is a supply-chain malware campaign in which a platform-signed system application was embedded in some Android firmware. According to Bitdefender’s 2026 analysis, the component can install or delete packages, grant permissions and load remotely supplied code without the approval normally required from an Android user.
The distinction matters. A conventional malicious app arrives after you set up a phone, usually through a download, deceptive link or third-party app store. Midnight Mimosa’s core component starts with system privileges because it resides inside the software image supplied with an affected device.
Bitdefender observed package names including com.android.system.lite, com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot in 2026. Those names aren’t definitive indicators: the researchers warned that package names and builds rotate.
At least 32 disguised payload apps were identified in Bitdefender’s 2026 investigation. They impersonated ordinary app-lock, weather, file-manager, optical-character-recognition, icon and audio-editing tools. The camouflage makes casual inspection unreliable, especially when the installer itself doesn’t appear in the normal app drawer.
Why is firmware malware harder to remove than a bad app?
Midnight Mimosa Android malware is harder to remove because its root component occupies the protected system partition rather than ordinary user storage. Bitdefender’s 2026 guidance says remediation requires trusted replacement firmware or disabling the component through Android Debug Bridge, commonly called ADB; deleting an installed payload leaves the privileged installer behind.
A standard Android factory reset wipes accounts, downloaded applications and other user data. Google’s 2026 Android help documentation explains that a reset doesn’t replace vendor firmware, so you shouldn’t assume it removes code already embedded in the system image.
The practical difference is persistence. Suppose you delete one disguised weather app and the system component installs a replacement later: you’ve removed one payload but reduced the underlying infection count by zero. BleepingComputer reported in October 2026 that some users saw suspicious packages return after removal, although no public manufacturer explanation accompanied those reports.
Android Verified Boot doesn’t settle the question either. The Android Open Source Project’s 2026 documentation says Verified Boot checks code against the original equipment manufacturer’s configured trust root. Correctly signed firmware can pass that check even if an unwanted component was present when the image was signed.
That limitation is easy to miss. Verified Boot can establish integrity relative to a configured signing authority; it cannot independently establish that signed firmware was benign. Firmware provenance and the trustworthiness of the update channel remain separate questions.
What does Midnight Mimosa do on an infected phone?
Midnight Mimosa Android malware primarily monetizes affected phones through fabricated advertising activity and enrollment as residential-proxy nodes. Bitdefender reported in 2026 that the privileged enabler could silently deploy payloads, grant permissions and load code, giving campaign operators substantially more control than an ordinary Play-distributed application receives.
The advertising modules generated artificial impressions or clicks. Proxy enrollment could make a device available as an internet exit point, allowing remote activity to appear as if it came from the phone owner’s residential connection.
There’s an important evidentiary limit. Bitdefender tested a proxy module using EnLoaderLib version 1.0.6 in 2026 and successfully enrolled a live node, but the command server returned no relay targets. Researchers therefore didn’t confirm that traffic was actually relayed during that test.
Accessibility, notification-access and SMS capabilities were also present in the analyzed software in 2026. Bitdefender did not observe those capabilities being exercised during its analysis, so claims that the campaign definitively read messages or abused accessibility would go beyond the published evidence.
Researchers further reported that the enabler temporarily disabled Google Play Store, installed payloads and enabled the store again. Bitdefender interpreted that sequence in October 2026 as a probable attempt to evade Google Play Protect, rather than proof that Play Protect itself had been compromised.
Which Android phones are affected?
No complete list of devices affected by Midnight Mimosa Android malware was publicly available as of October 13, 2026. Bitdefender linked the campaign to thousands of unique devices in more than 150 countries during 2024 and 2025, with the largest observed concentrations in Mexico, France and Italy.
The United States, Germany, Brazil and Spain followed those leading concentrations. Geographic telemetry shows where detections appeared; it doesn’t establish where the firmware was modified or where every affected device was sold.
| Observation | Published figure | Interpretation |
|---|---|---|
| Geographic reach | More than 150 countries in 2024–2025 | Wide distribution, not a complete sales map |
| Affected population | Thousands of unique devices in 2024–2025 | Confirmed telemetry, not a total infection estimate |
| Disguised payloads | At least 32 apps identified in 2026 | Multiple payload forms can appear |
| Published detection material | 120 MD5 sample hashes in 2026 | Useful investigation data, not a device blacklist |
| Related Google Play apps | 13 applications identified in 2026 | Family markers were related, but the apps lacked firmware-level privileges |
Bitdefender mentioned telemetry associated with Doogee S200 X, Cubot KINGKONG X and counterfeit flagship-style model strings in 2026. Those observations do not prove that every unit, firmware release or device currently sold under those names is infected. Treating model names as a blacklist would be inaccurate and unfair.
The exact insertion point also remains unknown. Bitdefender listed an original design manufacturer, firmware integrator, logistics partner or another intermediary as possibilities in its October 9, 2026 update. Certificates on some firmware bore the name Shenzhen Zediel, but the researchers explicitly said that detail doesn’t prove the company created, distributed or knew about the malware.
How can you check and secure a phone or business fleet?
Checking for Midnight Mimosa Android malware requires more than searching for one package name. In 2026, buyers and fleet administrators should verify Play Protect certification, record the exact model and build fingerprint, confirm the firmware source and update channel, and compare system packages and signing identities with a known-good vendor image.
Start with certification. Open Google Play Store, select Settings, then About, and inspect the Play Protect certification entry. Google’s 2026 guidance says certification indicates that a device passed Android compatibility testing, but certification doesn’t prove that every firmware component is benign.
Use the following checks in order, preserving evidence before you flash or retire a suspect device:
- Record the manufacturer, exact model, Android version, build fingerprint and Android security-patch level shown by the device in 2026.
- Confirm where the phone was purchased and whether its updates arrive through an authorized vendor channel rather than an unidentified download site.
- Check Google Play Protect certification under Play Store → Settings → About, while recognizing the limit of certification.
- Investigate unexplained system packages, silent app installations and applications that recur after removal. Don’t rely on a package name alone.
- Compare installed system packages and their signing identities against a known-good unit or an official vendor firmware image.
- For managed fleets, isolate suspect devices, preserve logs and indicators, and obtain trusted replacement firmware or qualified incident-response help before reconnecting them.
Android Enterprise supports policy-based fleet management and a dedicated Mobile Threat Defense role, according to Google’s 2026 developer documentation. Organizations should restrict procurement to traceable sellers, require managed enrollment, limit installations to approved applications and deploy mobile-threat detection.
Honestly, the cheapest unfamiliar handset only makes sense when its seller, firmware archive and update policy can be verified. Readers comparing new and refurbished budget phones in 2026 should price provenance into the purchase; a supported refurbished model may be the safer bargain.
Keep security patches current as well. Our coverage of the September 2026 Android update shows why documented update delivery matters, although a patch level alone cannot certify the provenance of an entire vendor image. For a different example of mobile compromise that bypasses normal user expectations, see the reporting on the WeChat zero-click calling worm.
If you confirm a suspicious firmware component, normal uninstall isn’t enough. Bitdefender’s 2026 remediation options are installation of trusted replacement firmware or disabling the component through ADB. ADB changes can disable the wrong system service and may be reversed by an update, so nontechnical users should seek the manufacturer’s documented image or professional support.
Midnight Mimosa Android malware FAQ
Will a factory reset remove Midnight Mimosa?
A standard Android factory reset should not be assumed to remove Midnight Mimosa because the reset erases user data rather than replacing vendor firmware. Trusted replacement firmware or targeted remediation is required when the privileged component resides in the system image.
Can Google Play Protect detect infected firmware?
Google Play Protect can scan applications and warn about harmful software, but Play Protect certification doesn’t guarantee that every vendor-firmware component is benign. Bitdefender reported in 2026 that the Midnight Mimosa enabler appeared to disable Google Play Store temporarily during payload installation.
Does a listed model name prove my phone is infected?
A listed model name does not prove that a phone contains Midnight Mimosa Android malware. Bitdefender warned in 2026 that telemetry references to particular models and counterfeit identifiers must not be applied to every unit or firmware release bearing those names.
Is Midnight Mimosa stealing SMS messages?
Bitdefender found SMS, notification-access and accessibility capabilities in the analyzed software in 2026, but researchers did not observe those capabilities being used. The published evidence supports potential access, not a confirmed claim that SMS theft occurred during testing.
Can antivirus remove firmware-resident Android malware?
Mobile security software may detect indicators or payloads, but ordinary app removal cannot erase a privileged component embedded in the system partition. Midnight Mimosa remediation requires a trusted firmware replacement or carefully disabling the root component through ADB.