Your Cheap Android Was Compromised Before You Turned It On

Uninstall will not save you. Play Protect will not save you. The malware was in the firmware when the phone left the factory, signed like a real system app, labeled “System,” and ready to farm ads and rent your IP as a residential proxy. Bitdefender calls it Midnight Mimosa. I call it supply-chain nihilism with a weather API.

On October 8, 2026, Bitdefender Labs published research on a preinstalled Android malware campaign affecting low-cost MediaTek devices sold through online marketplaces. Thousands of devices across more than 150 countries over roughly two years. Mexico, France, and Italy lead the counts, with the US, Germany, Brazil, and Spain close behind. The phone is owned before the unboxing video starts.

What it is

The core is a platform-signed, persistent system application. First sample flagged: com.android.system.lite. Same family also ships as com.android.sys.prot, com.android.sys.gmsprot, com.android.sys.bcprot, and friends. Package names rotate. The native core (libeasy.so or renamed twins), the dropped framework namespace cn.kw.lib, and C2 traffic to api.weatherlive.world do not.

Powers you do not get from the Play Store:

• INSTALL_PACKAGES / DELETE_PACKAGES as system uid (silent install and remove)
• GRANT_RUNTIME_PERMISSIONS (hand dangerous perms to cover apps without asking)
• Self-enabled Accessibility and Notification Access (not observed in use during analysis, but armed and remotely loadable)
• Remote DEX/JAR loading from C2 (arbitrary code after first boot)

Monetization is boring and effective: cover apps that look like weather, app-lock, OCR, and notes load real ad SDKs while a plugin fabricates impressions and clicks. Separately, a no-icon dropper (com.mobile.applock.en) enrolls the device as a TCP residential-proxy node. Ad fraud pays. Botnet exits pay. Your battery and bandwidth are the product.

The cute tricks

• Play Protect blind spot: pm disable com.android.vending right before silent install, then re-enable. The scanner naps during the drop.
• Forged Play provenance: installer field set to com.android.vending without Google Play frosting. Looks store-sourced. Is not.
• Payloads as PNGs: modules fetched from oss.showtimetool.com dressed as images.
• Counterfeit model strings: cheap MediaTek boards reporting “S25 Ultra” or “i17 Pro Max.” Also real budget rugged models (Doogee S200 X, Cubot KINGKONG X) in the telemetry.

Bitdefender also found thirteen Google Play apps sharing family markers and infrastructure. Two distribution channels: firmware and the official store. Removing one leaves the other.

What to do if you bought a $90 “flagship”

1. Stop buying mystery Androids off marketplace listings with flagship names and MediaTek guts. If the deal is impossible, the firmware is the business model.
2. On a suspect device, look for packages named like com.android.system.lite / com.android.sys.* labeled “System,” and for traffic to api.weatherlive.world.
3. Normal uninstall will not remove a system-partition enabler. Remediation is clean firmware or ADB disable, which most owners will never do.
4. Enterprise MDM: block unknown OEMs, watch for those package names and C2 domains, treat BYOD budget phones as hostile until proven otherwise.
5. If you installed weather or app-lock junk from Play on a corporate phone this month, audit it against Bitdefender’s published package list.

Sloth take

We spent years yelling about sideloading while the supply chain quietly shipped rootkits with a system signature and a weather-themed C2. Users cannot patch this with better passwords. Marketplaces and OEMs can. Until they do, the correct security control for a $90 “S26 Ultra” is a recycling bin.

Need a grown-up to look at your edge stack? Book a slot with Dark Edge Consulting. We do the boring, careful work so you can go back to ignoring your inbox.

Sources

• Bitdefender Labs, Midnight Mimosa (2026-10-08, updated 2026-10-09): bitdefender.com
• Android Authority summary: androidauthority.com
• ThaiCERT advisory (2026-10-12): thaicert.or.th
• OTX pulse coverage (2026-10-13): AlienVault OTX “Midnight Mimosa” pulse