Bitdefender uncovers ‘Midnight Mimosa’ preinstalled Android malware on low‑cost MediaTek phones spanning 150 countries

Security firm Bitdefender has identified a widespread Android threat dubbed "Midnight Mimosa" that arrives preinstalled on inexpensive smartphones powered by MediaTek chipsets, affecting users in roughly 150 nations.

The malicious package disguises itself as a system component, making removal through ordinary means impossible. Once active, it fabricates ad clicks to generate revenue, silently pushes additional unwanted applications, and converts the device into a node of a proxy‑based botnet.

Researchers at Bitdefender traced the infection to a supply‑chain compromise, noting that the malware is embedded by manufacturers before the phones reach consumers. Analysis of network traffic revealed repeated connections to command‑and‑control servers, prompting a deeper reverse‑engineering effort that confirmed the code’s capabilities.

Cheap Android handsets often rely on MediaTek processors because of their cost efficiency, but the ecosystem sometimes lacks rigorous vetting of bundled software. In this case, third‑party code was integrated into the firmware without adequate security review, exposing a large user base to exploitation.

Beyond the immediate annoyance of unsolicited apps and inflated data usage, the botnet functionality raises broader concerns. Compromised devices can be marshaled for large‑scale attacks, such as distributed denial‑of‑service campaigns or credential harvesting, extending the impact far beyond the individual phone owner.

Bitdefender has reported its findings to Google, MediaTek and the implicated device manufacturers, urging swift remediation through firmware updates. Security experts recommend that owners of affected models verify the presence of unexpected system apps, apply any available patches, or consider installing a clean custom ROM where feasible. The episode underscores the growing need for tighter oversight of the Android supply chain, especially for budget devices that dominate emerging markets.