embedded devices

Bitdefender researchers have documented a campaign called Midnight Mimosa: Android malware that comes preinstalled in the firmware of low-cost, multi-brand devices built on MediaTek platforms. Because the malware is embedded before the phone is ever switched on, users are infected out of the box. Security experts are sharing the findings as a warning to buyers of budget Android handsets.

Security researchers at Bitdefender are warning about malware found embedded deep in the firmware of inexpensive Android smartphones. The malicious software is installed at the factory, meaning it is present on devices before buyers even switch them on, making it difficult to detect or remove. The finding highlights the risks of budget devices from lesser-known manufacturers, and experts are advising users to be cautious when buying very cheap Android hardware.

Security firm Bitdefender has uncovered a malware campaign dubbed 'Midnight Mimosa' affecting budget Android phones with MediaTek chips. The malware is embedded in the firmware itself, with system-signed packages that silently install apps, carry out ad fraud and turn devices into residential proxies. Thousands of infected devices have been identified across more than 150 countries, with brands such as Doogee and Cubot among those affected.

Security researchers have identified a new malware strain dubbed Midnight Mimosa that comes preinstalled on low-cost Android devices, meaning buyers are infected before ever using the phone. Because the malware is embedded at the firmware level, factory resets and standard removal methods typically fail. Cybersecurity communities are sharing the findings widely, warning budget-phone buyers to be cautious about unbranded or deeply discounted devices.