Thousands of Android Phones Ship With Hidden Malware That Disables Google Play Protections

Thousands of Android phones across more than 150 countries have reportedly been affected by Midnight Mimosa, a malware campaign involving malicious software embedded in device firmware before purchase. The threat is particularly concerning because users may become infected without downloading a suspicious application or clicking a malicious link.

Researchers reported that the malware can install applications silently, download additional code, commit advertising fraud, and potentially turn infected devices into internet proxies. Its privileged position within Android firmware makes detection and removal more difficult than dealing with an ordinary malicious app.

What Is Midnight Mimosa Android Malware?

Midnight Mimosa is a campaign associated with malware hidden in the firmware of certain low-cost Android devices. According to research published by PolySwarm on October 19, 2026, the investigation draws on Bitdefender’s analysis of infected devices observed over approximately two years.

The malware begins with a system application signed using an Android platform certificate. This elevated trust position gives the component capabilities that ordinary applications do not normally possess, including installing packages, removing applications, granting permissions, and changing protected settings.

Researchers observed infections across more than 150 countries. Mexico, France, and Italy had the highest observed counts in the reported data, followed by the United States, Germany, Brazil, and Spain. These figures represent observed infections and do not, by themselves, establish that users in those countries were specifically targeted.

How the Malware Hides Inside Android Firmware

The malware conceals important functionality inside a native library called libeasy.so. When loaded, the library uses RC4 encryption to unpack a hidden Java framework.

The framework communicates with command-and-control infrastructure, receives configuration information, and downloads additional Android code modules in DEX or JAR formats. This modular approach allows operators to change the malware’s functionality without replacing the original firmware component.

Researchers identified payloads associated with advertising fraud and silent application management. Some modules generate fake advertising views, clicks, and conversion events through hidden windows and automated interactions.

The activity can be disguised as behavior from seemingly ordinary applications, including weather tools, app lockers, text scanners, and file managers. Bitdefender identified at least 32 disguised applications within the wider payload network.

Why the Malware Temporarily Disables Google Play

One of the campaign’s notable techniques involves temporarily disabling the Google Play Store package before installing additional software, then restoring it afterward.

Researchers assess this behavior as an attempt to avoid Google Play Protect detection. However, this finding does not prove that every Android security mechanism is permanently disabled or that every infected device behaves identically.

Some malicious applications also reportedly claim Google Play as their installation source despite lacking the signature block associated with distribution through the official store. Such inconsistencies can help investigators distinguish an application’s claimed origin from evidence of how it was installed.

Separately, researchers identified 13 related advertising-fraud applications distributed through Google Play. These applications shared malware indicators and infrastructure, but did not have the same privileged access as the firmware-installed component.

Advertising Fraud and Potential Proxy Abuse

Advertising fraud is one of the documented purposes of the campaign. Malicious modules can generate artificial advertising activity, potentially creating fraudulent revenue while consuming a device’s resources and network bandwidth.

Researchers also identified a payload containing proxy software capable of registering a device and establishing two-way TCP tunnels. In principle, this functionality could allow external traffic to pass through an infected phone’s internet connection.

There is an important distinction between capability and confirmed use: the investigation identified the proxy functionality but did not observe actual traffic relaying during the documented test. Researchers also reported that an initially identified control endpoint was later recognized as a sinkhole.

The malware’s underlying framework includes functions related to Android Accessibility, Notification Access, and SMS permissions. Researchers did not observe these capabilities being used for theft in the investigation, but the ability to download additional code means the threat could change as new modules are introduced.

Which Android Devices Could Be Affected?

Reported affected devices included inexpensive MediaTek-based phones, counterfeit flagship models, and devices reporting identifiers associated with Doogee and Cubot products.

Researchers also found firmware certificates carrying identifiers associated with Shenzhen Zediel. However, they could not establish where the malware entered the supply chain or determine that the certificate owner knowingly participated.

Connections to other malware families, including Joker, Phantom, and Click, should likewise not be treated as proof that the same operators are responsible.

Because the malware can reside in firmware, deleting a visible malicious application may not resolve the underlying infection. The firmware component may remain capable of installing replacement payloads.

How Android Users Can Reduce Their Risk

Users should take practical precautions, particularly when buying inexpensive devices from unfamiliar sellers:

1. Buy from reputable sources. Prefer established manufacturers and authorized retailers that provide reliable firmware updates.
2. Check Play Protect. Confirm that Google Play Protect is enabled and review any security warnings. These checks are useful, but they cannot guarantee that a compromised firmware image is clean.
3. Install official updates. Apply firmware and Android security updates provided by the device manufacturer.
4. Review unusual behavior. Unexpected applications, unexplained data consumption, excessive advertising, or unfamiliar permission activity warrant investigation.
5. Avoid relying on app deletion alone. If firmware-level compromise is suspected, contact the manufacturer or a qualified device-security professional to assess the underlying system software.
6. Protect sensitive accounts. Avoid using a device suspected of compromise for sensitive activities until its integrity has been assessed. Use a separate, trusted device to review important account security settings if necessary.

Google explains that Play Protect checks applications during installation and periodically scans devices. These protections remain valuable, but the Midnight Mimosa findings highlight why firmware integrity and the device supply chain also matter.

Indicators of Compromise (IoCs)

The research identifies the following indicators for security teams investigating potential Midnight Mimosa activity. These indicators should be validated against current threat-intelligence sources before being used for detection.

The original research also lists 40 sample SHA-256 hashes. Security teams should consult the source report for the complete list and verify each hash before adding it to detection rules. Domains are intentionally defanged to reduce accidental navigation.

Conclusion

Midnight Mimosa demonstrates how preinstalled Android malware can undermine device security before a customer even turns on a new phone. Its firmware-level privileges, modular payload system, advertising-fraud capabilities, and potential proxy functionality make the campaign significant for consumers and security professionals.

The investigation does not establish that every affected device was used for data theft or proxy traffic, nor does it prove that every associated manufacturer or certificate owner knowingly participated. Nevertheless, it reinforces an important security lesson: a clean-looking app list does not guarantee that a phone’s underlying firmware is trustworthy.

Consumers should choose reputable devices, keep software updated, and investigate suspicious behavior. Organizations should also consider firmware provenance and device integrity when allowing personal Android devices to access corporate accounts or networks.

Sources

• PolySwarm — Midnight Mimosa malware campaign exploits Android firmware supply chain
• Bitdefender — Midnight Mimosa malware research
• Google — Google Play Protect