Low-cost Android phones are arriving with malware that owners can’t uninstall

Malware, dubbed Midnight Mimosa, is found on budget Android devices built on MediaTek platforms sold through online marketplaces. The malware is present in the device firmware before the user powers the phone on and cannot be uninstalled by the owner. This malware operates with system-level privileges, allowing it to manage applications, grant permissions, and load arbitrary code remotely. Operators use this access to install and delete apps, configure devices, and integrate them into botnets for activities like ad fraud, click fraud, and gathering device information.
The campaign targeted thousands of devices across over 150 countries, with Mexico, France, and Italy leading the affected regions. Some of the infected models include counterfeits bearing flagship names such as "i17 Pro Max" and "S25 Ultra." The most common models observed were the Doogee S200 X and Cubot KINGKONG X.
The infection was detected when a system component, com.android.system.lite, exhibited anomalous behavior by activating accessibility and notification access and installing or removing applications. The malicious code resides in a native library that activates only at runtime, disguised as a system process. The malware exfiltrates data such as IMEI, Android ID, MAC address, and timezone to a command and control server, also obtaining permissions for reading screens, messages, and SMS.
The malware deploys disguising applications to facilitate ad fraud by showing unauthorized ads in windows overlaid on the screen, often marked as secure. Settings from the command and control server determine click registration and ad placement to mimic human interaction. The method involves installing applications across the device and Google Play, using multiple developer accounts for signing certificates, and preemptively disabling security scanners like Play Protect before installation.

* Malware operates on budget Android devices built on MediaTek platforms.
* The malware is shipped in the device firmware before the user powers the phone on.
* The malware runs with system-level privileges, enabling silent app installation/removal, permission granting, and arbitrary code loading.
* Operators use this access to install and delete apps and tune devices for botnets.
* The scheme generates revenue through ad fraud, click fraud, and collecting device information.
* Infected devices are turned into residential-proxy relay nodes in botnets.
* Affected models include Doogee S200 X and Cubot KINGKONG X.
* The infection was found when com.android.system.lite repeatedly switched on Accessibility and Notification Access and installed/removed apps.
* Malware exfiltrates IMEI, Android ID, MAC address, and timezone to a C2 server, and requests Accessibility, Notification Access, and SMS permissions.
* The malware installs and removes at least 32 disguised apps, including ad SDKs that generate revenue.
* Some models are counterfeits with names like "i17 Pro Max" and "S25 Ultra."
* The malware code is often hidden in a native library activated at runtime under various names, including com.android.sys.prot.

The mechanism described reveals a systemic vulnerability that moves beyond simple application security to deeply embedded supply chain integrity. The core issue is not just the presence of malicious code but the establishment of a persistent, unremovable foothold at the firmware level, which subverts the fundamental trust relationship between the user and the operating system itself. The fact that the malware leverages system-level privileges to manipulate permissions like Accessibility Access demonstrates an exploitation of deeply nested security controls; the operators do not need traditional app-level exploits but rather systemic access hooks that bypass standard user protections.
The pattern of deploying multiple, disguised apps that mimic legitimate functions (weather, file manager) alongside malicious ad delivery suggests a strategy built on overwhelming camouflage. The use of rotating signing identities and code sharing across packages implies an operational security practice designed to evade forensic analysis by making any single piece of evidence untraceable. This shifts the focus from patching vulnerabilities to understanding the entire deployment pipeline—from the initial hardware sourcing, through firmware integration (potentially via ODMs or logistics partners), to the marketplace distribution.
The inability for end-users to effectively remediate this due to system-level persistence forces a re-evaluation of what "ownership" means in a connected device context. If remediation requires firmware-level intervention or complex developer tools, it creates an insurmountable barrier for the average consumer, centralizing control over security and recovery with the vendors and distributors rather than the end-user. The ultimate implication is that cognitive sovereignty is eroded when the foundational trust layer of technology—the operating system—can be compromised without visible user consent or recourse.
Bridge Questions: If remediation requires vendor action, what accountability structures must exist between hardware manufacturers, firmware integrators, and online marketplaces? How can security paradigms shift from reactive patching to proactively validating supply chain integrity at every layer of distribution? What mechanisms could empower end-users to verify the provenance and runtime behavior of system components outside of standard developer tools?