Bitdefender flags preinstalled malware on budget Android handsets
Bitdefender uncovered a campaign called Midnight Mimosa in which inexpensive Android phones arrive with malicious code embedded in firmware before first use. The code runs with system-level access, cannot be uninstalled by the owner, and can silently add or remove apps, grant permissions, and execute remotely supplied code. Researchers observed it on thousands of devices across more than 150 countries, with operators apparently seeking revenue through ad and click fraud, device data collection, and turning phones into proxy relays or botnet nodes.
Bitdefender's investigation began when an anomaly detector flagged a component named com.android.system.lite, which behaved unlike legitimate system software — repeatedly enabling Accessibility and Notification Access and quietly adding or deleting unrelated apps. The component is platform-signed, labeled "System," has no icon, and hides its payload in a native library that activates only at runtime, so behavioral monitoring was the only detection route.
The same code appears under several package names, including com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot. Infected hardware spans many brands on MediaTek platforms, and some units are counterfeits borrowing flagship names such as "i17 Pro Max" or "S25 Ultra"; Doogee S200 X and Cubot KINGKONG X were the most frequently seen models.
Buyers of inexpensive handsets — often in Mexico, France, Italy and beyond — could be affected without any action on their part, since the code predates first boot and resists removal. Beyond nuisance ads, their devices may be conscripted into proxy relays or botnets, exposing personal data and consuming bandwidth. Because the flaw sits in firmware rather than an app, ordinary security advice may offer little protection, and trust in budget marketplaces could suffer.