In the realm of budget and midrange Android smartphones, consumers are often faced with a myriad of options. However, the allure of extremely low prices from lesser-known brands warrants a moment of caution. A recent report from digital security research firm Bitdefender has shed light on a concerning trend: malware embedded in generic smartphones. This malware, designed to generate revenue for its creators, infiltrates devices by inserting legitimate advertisements into installed applications and concealing fraudulent ad behavior beneath the surface. Furthermore, it opens exploitable pathways for potential hackers to gain control over these devices.
Bitdefender has named this malware campaign “Midnight Mimosa.” It is particularly prevalent in devices powered by low-energy MediaTek chipsets, which are often marketed under various labels, including Cubot and Doogee, as well as counterfeit versions of popular models like Samsung’s Galaxy S24, S25, and S26. The malware manifests itself through an application simply titled “System,” identified by the package name com.android.system.lite. This application operates as a fully-privileged process, orchestrating the download and deletion of seemingly innocuous weather, app-lock, and utility applications. These apps serve as a facade, allowing the malware to display full-screen and invisible ads to users, even if they have never interacted with those applications. Notably, the malware is crafted to evade detection, cleverly bypassing security scans.
Bitdefender’s research indicates that thousands of devices have been tracked with this malware throughout 2024 and 2025, with the potential for even more to be affected. Among the impacted devices, 13% were identified in Mexico, marking it as the most affected country. The United States ranked fourth with 8%, while Canada followed in ninth place with less than 3%. The researchers faced challenges in pinpointing the exact stage of the supply chain where this malware was introduced, whether at the device manufacturer, firmware supplier, or during transport. However, a significant clue lies in the payload apps, which trace back to a single source: Android ODM Shenzhen Zediel.
Malware like this can have bigger implications
The implications of such malware campaigns extend beyond individual devices, casting a shadow over the gray market for Android phones. Notably, U.S.-based ODM Blu faced scrutiny from the FTC in 2018 for allowing its firmware contractor to harvest user data, including text messages and call logs. In a separate incident in 2016, another firmware contractor, Ragentek, deployed an updater binary that could have been exploited by unauthorized parties, affecting millions of devices from brands such as Blu, Infinix, Doogee, and Xolo. The stakes are similarly high in the Midnight Mimosa campaign, as the malware has the potential to install applications beyond ad fraud, including those that could engage in bot swarms and DDoS attacks.
While the payload apps attributed to Shenzhen Zediel have been in circulation for some time, they represent just one facet of the broader scheme. Bitdefender researchers have identified 13 additional apps containing similar ad fraud-related code, all signed by the same entity, which were available on the Google Play Store. Although these apps have since been removed, their presence in the open marketplace highlights the vulnerability of everyday users. Major manufacturers like Google, Motorola, and Samsung are not without flaws—previous security vulnerabilities have been discovered in Pixel phones—but they maintain security protocols designed to safeguard their firmware, including update processes and responsive measures for users in the event of issues.
