Thousands of Android Phones Preinstalled with Hidden Malware That Disables Google Play Protections

Security researchers have found firmware-level malware on thousands of Android phones in more than 150 countries. The threat, dubbed “Midnight Mimosa,” primarily affects low-cost devices and gives operators system-level control without requiring users to install an app or interact with a malicious link.

The malicious firmware can silently install and remove applications, load new code, and simulate advertising activity. Before delivering additional payloads, the malware temporarily disables the Google Play Store package and then restores it. Researchers interpret this as an evasion technique intended to reduce detection by Google Play Protect rather than evidence that Play Protect remains permanently disabled.

PolySwarm published a research report on Midnight Mimosa on October 19 describing the malware’s firmware-level access. Their analysis references an investigation by Bitdefender that tracked thousands of infected devices over an approximately two-year period.

Observed infection counts were highest in Mexico, France, and Italy, followed by the United States, Germany, Brazil, and Spain. These figures reflect observed infections, not definitive targeting decisions.

Thousands of Android phones ship with hidden malware

The infection begins with a malicious system app signed with an Android platform certificate. Because it holds a trusted platform position, the component can install and remove packages, grant permissions, and modify protected settings.

Previous incidents of preinstalled Android malware show that checking only user-installed apps is insufficient when a threat is embedded in device firmware.

The enabler conceals its core functionality inside a native library. When loaded, that library uses RC4 to decrypt a hidden Java framework. The framework contacts command-and-control servers, retrieves configuration, and downloads DEX or JAR plugin modules. These plugins allow operators to change the malware’s behavior without replacing the original system application.

Specific plugins perform ad-fraud and silent app management. Some create fake ad impressions, clicks, and conversion events by opening hidden windows and automating interactions. The visible apps used to mask this behavior include everyday utilities such as weather apps, app lockers, text scanners, and file managers; Bitdefender identified at least 32 such disguised applications in the larger payload network.

How the malware evades checks

Temporarily disabling the Play Store provides a window to install additional apps while attempting to avoid detection. Some malicious payloads also report Google Play as their installer even though they lack the Play-distribution signature block. That mismatch can help investigators differentiate between a claimed installation source and how an app was actually installed.

These findings expand earlier Midnight Mimosa research showing how a hidden firmware component persists while visible payloads change. In addition to firmware-installed components, researchers found 13 related ad-fraud apps distributed via Google Play; those apps shared infrastructure and indicators with the campaign but did not possess the privileged access granted by firmware placement.

The firmware enabler also contains routines tied to Accessibility, Notification Access, and SMS permissions, including methods that can enable sensitive access automatically. While researchers did not observe these permissions being used for theft, the malware’s ability to fetch and run new code means its future behavior cannot be judged solely on the ad modules already analyzed.

One payload includes proxy functionality capable of registering a device and opening two-way TCP tunnels. This could allow external traffic to traverse an infected phone’s internet connection. Researchers confirmed the capability but did not observe active traffic relaying during their documented tests; an initially reported control endpoint later proved to be a sinkhole.

The wider risk resembles abuses seen in malicious residential proxy networks, where compromised consumer devices are used to provide network access to third parties. That resemblance does not prove an operational link, but proxy features in Midnight Mimosa could expose homes or workplaces to traffic they did not authorize.

Affected devices included inexpensive MediaTek-based handsets, counterfeit flagship models, and phones reporting identifiers associated with Doogee and Cubot. Some firmware certificates contained identifiers linked to Shenzhen Zediel. Researchers were unable to determine exactly where in the supply chain the malware was introduced or whether the certificate owner knowingly participated.

Connections between Midnight Mimosa and other families such as Joker, Phantom, and Click are based on shared indicators but do not prove a single operator. Removing a visible app may leave the firmware enabler able to reinstall replacements, so cleanup requires addressing the underlying firmware rather than only removing individual payloads.

Google notes that its app safety checks scan apps during installation and perform periodic device scans, but this case highlights the need to also scrutinize trusted system components.

Indicators of compromise (IoCs)

The original report lists 40 sample SHA-256 hashes. They are reproduced here exactly as published; the report does not assign individual hashes to specific packages.

Note: IP addresses and domains are intentionally defanged (for example, [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from security operations centers to improve protection.