On October 8, 2026, Bitdefender published an analysis of Midnight Mimosa, a malware family found in the firmware of some low-cost Android phones. The components were installed before buyers first used the devices. Researchers describe ad-fraud modules and remote capabilities; they do not know who introduced the code or at what point in manufacturing or distribution.
A system component already present at purchase
The analysis covers apps embedded in the system partition and signed with elevated privileges. Some package names imitate Android components. One module Bitdefender studied could install or remove other apps without user interaction.
Researchers linked the campaign to several device models and families, including phones from Doogee and Cubot. BleepingComputer also reports devices impersonating well-known brands. This does not mean the named manufacturers took part: sources have not established who modified the firmware or at which supply-chain stage.
Ad fraud and remote capabilities
Bitdefender describes components that display ads in the background and simulate clicks, potentially generating fraudulent advertising revenue. The analysis also says some devices could be turned into residential proxy nodes or added to botnets. These observations concern the samples and infrastructure the company examined; they do not prove that every affected device was used for every purpose.
Researchers identified sensitive permissions related to accessibility, notifications, and SMS. They say they did not observe those permissions being used during their analysis, while noting that they could be granted and enabled remotely. A technical capability in code should therefore be distinguished from confirmed abuse.
Why an ordinary reset may fail
Users can generally uninstall an app they installed. A privileged component embedded in the system partition follows a different path and may survive a reset that erases user data. BleepingComputer reports that some owners saw suspicious apps return after removing them.
Sources say some manufacturers released updates that reportedly resolved infections, but they do not provide a universal detection tool or a complete, confirmed list of every affected model. Avoid installing firmware found on forums or third-party sites: an unverified image can worsen the compromise or make the phone unusable.
What to do if your phone may be affected
Record the exact model, firmware version, and where you bought the phone. Contact the manufacturer or seller through an official channel to ask for an authentic update and the applicable recovery process. If apps keep reinstalling, the device generates unusual traffic, or a security product flags a suspicious system app, limit its use for sensitive accounts until the issue is understood.
From another trusted device, review active sessions for accounts used on the phone and revoke unfamiliar ones. Change affected passwords if there are signs of unauthorized access, and enable multifactor authentication where available. These steps reduce account risk; they do not clean the phone’s firmware.
How Soclyde relates
Soclyde cannot detect or remove malware preinstalled in Android. Its local-first encrypted vault lets people manage passwords without a Soclyde account or a centralized vault operated by Soclyde, but the integrity of a compromised device remains a separate concern. Avoid using a device of uncertain integrity to rotate secrets.
What to remember
Midnight Mimosa illustrates a risk that can exist before a buyer installs any apps: the device may arrive with privileged components in its firmware. Ad-fraud activity is documented, while some permissions represent capabilities researchers did not observe being used. Ask the manufacturer for a verified remedy, and see our guide to responding to a hacked password if you need to protect accounts used on the phone.
