LowII Cyber Warfare & Critical Infrastructure8 October 2026, Thursday
Cheap Android phones ship with malware that cannot be removed
Bitdefender said on 8 October that malware called Midnight Mimosa, embedded in the software of low-cost Android phones with MediaTek processors, has reached thousands of devices in more than 150 countries over about two years.
BleepingComputer reported on 8 October that the malware comes embedded in the device firmware and cannot be removed by normal means because it runs with system privileges. It installs at least 32 apps without asking the user. Bitdefender says the main aim is not data theft but ad fraud and turning the device into a residential proxy that carries other people's traffic.
Affected models include the Doogee S200 X, Doogee Fire 3 Max and Cubot KINGKONG X, and the list also contains counterfeit devices imitating Samsung and Apple. Security Affairs reported on 11 October that some of the firmware was signed with certificates linked to Shenzhen Zediel. Bitdefender could not determine whether the company was aware, and noted that some devices do not use this certificate. As of 11 October, it is therefore unknown at which link in the supply chain the tampering took place.
The most affected countries are Mexico, France, Italy, the US, Germany, Brazil and Spain. Thirteen apps on Google Play were found connecting to the same servers; they were published from at least two developer accounts with 13 separate certificates. Because Bitdefender's test device received no proxy traffic targets, active traffic routing could not be verified as of 8 October.
Talay assessment
Bottom line
The threat stems not from one company's flaw but from unpoliced links in the supply chain for cheap devices. Because the malware ships from the factory, security apps and user vigilance are not enough. In the near term, a few manufacturers are expected to clean up through software updates. While the compromised link stays unidentified, similar setups may surface in other brands.
Likely effects
- Enterprise mobile securityNegative1–6 months
Companies that issue cheap devices to field staff let a backdoor with system privileges into their networks, and approved device lists will narrow.
- Residential proxy networksNegative1–6 months
These networks let attackers hide behind home IP addresses, making IP reputation a weaker signal for authentication.
- Chinese electronics exportsNegative6 months+
Certificates linked to Shenzhen strengthen calls for import checks on low-end Chinese devices.
Possibilities, ranked
- 1Limited clean-up via updates55%
Some manufacturers release software updates, but the source link is not disclosed.
Watch: Official statements from Doogee and Cubot or clean firmware releases
- 2Regulatory response30%
An EU or Latin American regulator issues sales warnings or demands a recall of affected models.
Watch: Model-specific warnings from consumer or cyber security agencies in Mexico, France or Italy
- 3Scope widens15%
The same setup is found in better-known brands or in tablets.
Watch: Another security firm reporting the same package names in new brands
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Countries affected▼ 150+
- Apps installed silently▼ 32