If you are thinking of buying a budget, knock-off Android phone, you'd better think again. Researchers from security firm Bitdefender have exposed a dangerous malware found on generic cheap Android devices. The malicious software is called Midnight Mimosa and comes preinstalled on these cheap Android phones.
Midnight Mimosa found on cheap MediaTek phones
Midnight Mimosa sounds poetic, but it's dangerous. | Image by Bitdefender
The guys at Bitdefender have published a detailed report, but long story short, the software runs ads on these cheap phones to generate revenue in a botnet-type scheme. This malicious software comes preinstalled, before users even switch on their phones, and can't be removed.
What's even more problematic is that this software leaves backdoors for hackers to take control of the affected phones and do further damage.
Midnight Mimosa disguises itself as an app called "System" and, according to the researchers, is "the tip of the iceberg."
As their investigation continued, Bitdefender identified the same malware core shipping under a set of system-sounding names, including com.android.sys.prot, com.android.sys.gmsprot, and com.android.sys.bcprot.
The malware is undetectable by most security scans
Affected phones by region. | Image by Bitdefender
The security experts say that Midnight Mimosa is designed to conceal the scheme and bypass normal security scans. The bad news is that it remains unknown where exactly in the supply chain this malware is installed.
Recommended For You
This malware is also installed at a firmware level, so it can't be uninstalled the normal way. However, the affected phones are not your popular Galaxy and Google flagships, so if you stick to popular brands and avoid counterfeits, you should be fine.
Speaking of affected phones...
How many cheap Android phones do you currently own?
3 Votes
Affected Android phones
Galaxy counterfeits and cheap phones from brands such as Doogee and Cubot are among the affected devices. | Image by Bitdefender
Bitdefender says that thousands of phones have been infected with this malware over 2024 and 2025, and there could be more undetected cases in 2026.
Midnight Mimosa is most widespread in Mexico, accounting for 13% of all cases, while the US is fourth with 8%.
Among the affected brands are Doogee and Cubot, along with cheap fake Galaxy S24, S25, and Galaxy S26 devices. The connecting link is the MediaTek chipset, but other than that, there's no way to spot a bad apple.
This isn't the first time cheap Android models have posed a security threat.
Not the first time cheap Android phones ship with malicious software
Back in 2016, Ragentek—a firmware contractor—installed a backdoor on millions of phones from Blu, Infinix, Doogee, Xolo, and other brands. The malware connected to two suspicious web domains and turned the affected phones into bots in a revenue-generating scheme.
Two years later, ODM Blu made headlines for allowing its firmware contractor to illegitimately collect personal data, texts, call logs, and more.
Where does all this leave us?
Should you be worried?
The malicious app disguises itself as a System software. | Image by Bitdefender
There's no reason to panic, even if you bought a cheap knock-off Android or a Galaxy counterfeit. The malware steals system resources to generate clicks and doesn't steal money. It's dangerous, of course, and you shouldn't carry on using an affected phone, but removing the SIM card and powering off the device should do the trick.
Finding out if your phone is affected is a bit tricky—you should look for the System app with the corresponding icon (picture above), or any of the processes described earlier.
But the general advice here is: don't buy cheap knock-offs and instead rely on budget Android phones from reputable brands. The Samsung Galaxy A07 can be found on a deal for around $150, so there's no reason to take a risk with a counterfeit or a shady brand.
Read more about security breaches and malicious software here:
Mint Mobile is celebrating its 10-year anniversary with a special offer on its six-month subscription plans. For a limited time, you can get your preferred tier (6GB, 17GB, 23GB or unlimited) for just $10/mo. That saves you between 50% and 71% on the carrier's mobile plans, making it way easier to recommend.
Mariyan, a tech enthusiast with a background in Nuclear Physics and Journalism, brings a unique perspective to PhoneArena. His childhood curiosity for gadgets evolved into a professional passion for technology, leading him to the role of Editor-in-Chief at PCWorld Bulgaria before joining PhoneArena. Mariyan's interests range from mainstream Android and iPhone debates to fringe technologies like graphene batteries and nanotechnology. Off-duty, he enjoys playing his electric guitar, practicing Japanese, and revisiting his love for video games and Haruki Murakami's works.
A discussion is a place, where people can voice their opinion, no matter if it
is positive, neutral or negative. However, when posting, one must stay true to the topic, and not just share some
random thoughts, which are not directly related to the matter.
Things that are NOT allowed:
Off-topic talk - you must stick to the subject of discussion
Offensive, hate speech - if you want to say something, say it politely
Spam/Advertisements - these posts are deleted
Multiple accounts - one person can have only one account
Impersonations and offensive nicknames - these accounts get banned
To help keep our community safe and free from spam, we apply temporary limits to newly created accounts:
New accounts created within the last 24 hours may experience restrictions on how frequently they can
post or comment.
These limits are in place as a precaution and will automatically lift.
Moderation is done by humans. We try to be as objective as possible and moderate with zero bias. If you think a
post should be moderated - please, report it.
Have a question about the rules or why you have been moderated/limited/banned? Please,
contact us.
Things that are NOT allowed:
To help keep our community safe and free from spam, we apply temporary limits to newly created accounts: