Thirteen apps on Google Play were found communicating with the same servers that control a piece of preinstalled firmware malware, according to Bitdefender — a detail that underlines this campaign stretches beyond devices that arrive preinfected out of the box.
Midnight Mimosa: the campaign and its payloads
Security vendor Bitdefender is tracking the activity as "Midnight Mimosa." The core component, appearing as the package com.android.system.lite, is baked into device firmware on low-cost Android phones built on MediaTek platforms and runs with system-level privileges. That access allows the component to install and uninstall apps, grant itself additional permissions (accessibility services, notifications, SMS), and load arbitrary code supplied remotely by the operators.
Bitdefender says the root component fetches a remote configuration from an external server and then downloads and executes additional payloads. Those payloads include dropper apps that masquerade as benign utilities, but in practice drive monetization: they incorporate proxyware, ad-fraud behavior and code-execution features, and use a real advertising SDK to load ads invisibly. Rather than clicking ads themselves, the report explains, the droppers "load an invisible window on top of apps that registers the ads being shown."
Technical behavior: Play Store disabling, permissions and proxyware
The malware disables the Google Play Store app before installing a payload app and re-enables the Play Store after the payload is run, likely in an effort to bypass Play Protect safeguards. Bitdefender also observed the capability to grant permissions to any Android app package, and to perform silent installation or removal of partner apps.
Bitdefender summarizes the operators' intent bluntly: "This essentially means its operators could install and delete apps at will, tuning each device to their needs, including making them part of large botnets." The company adds that the campaign's "scheme is likely designed mainly to generate revenue" through ad and click fraud, data collection, and by turning infected phones into residential-proxy relay nodes.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildSupply-chain signals and certificate tracing (Shenzhen Zediel Co., Ltd)
The preinstalled nature of the component points to a compromise in the device supply chain rather than ordinary sideloading. Bitdefender found the malware on firmware signed with certificates attributed to Shenzhen Zediel Co., Ltd, a Chinese Android device manufacturer, though it stated that "it's unclear at this stage if the certificate owner was involved in or aware of the malware deployment." The investigation also encountered other company names during analysis.
Bitdefender noted infrastructure overlaps with Android.Phantom, a family Doctor Web previously documented as bundled in modified apps and games to conduct click fraud, and reminded readers that firmware-level backdoors are not new — citing Kaspersky's disclosure last year of "Keenadu," a preinstalled ad-fraud malware observed on some tablets.
Geography of infections and the Play Store footprint
Most infected devices identified in Bitdefender's telemetry are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland and Thailand. The vendor also identified a set of apps on Google Play that communicate with the same control servers as the preinstalled component:
- com.audify.editor.wavrge
- appicon.diy.tools.prop
- com.audify.editor.pro
- com.prorestore.qr
- com.message.recovery.prorestore
- com.go.weather.mot
- com.cool.weather.yl
- com.dmstudio.weather
- com.dl.guard.lock
- picturetranslate.extractor.text.lite
- com.notemaster.record.mark
- com.arabmusic.tap.aghani_tamerhosny
- org.life.goal.tools
What this means for end users, technologists, and marketplaces
End users: Because the root component ships in the system partition, an affected owner "cannot remove it by the normal route." Bitdefender warns that clearing the device requires firmware-level cleanup or disabling the component over ADB, and that "neither is realistic for most people who own these phones."
Technologists and security teams: The campaign highlights that devices built on MediaTek platforms and devices with preinstalled firmware deserve heightened scrutiny. Detection and remediation will need to account for system-level persistence and the presence of control servers reachable both from firmware and Play Store apps.
Marketplaces and vendors: Bitdefender points the finger at supply-chain controls and firmware provenance: "The durable fix sits with the vendors and the marketplaces that ship and sell the affected firmware." Where firmware is shipped with permanent components, traditional user-facing defenses such as install prompts and Play Protect cannot by themselves prevent abuse.
Preinstalled, system-level malware alters the threat model for cheap phones: when the persistent component is already part of the firmware, normal uninstall routes and user vigilance are insufficient. Bitdefender's findings leave at least one clear open question — whether certificate owners such as Shenzhen Zediel Co., Ltd were complicit, negligent, or themselves compromised — and it places the onus for durable remediation squarely on device vendors and marketplaces.
Read the original Bitdefender-based report: https://thehackernews.com/2026/10/low-cost-android-phones-ship-with.html
