Malicious software known as Midnight Mimosa has been discovered in the firmware of certain low-cost Android smartphones before they are sold to consumers. Researchers from Bitdefender found a suspicious package called com.android.system.lite on devices using MediaTek chips. This component is labeled "System" without an icon and has high-level system privileges, allowing its operators to install or remove apps without the user's knowledge and load code from their own servers. The software also transforms some devices into residential proxies, enabling other hackers to route their internet traffic through the infected device's IP address. Over two years, thousands of devices across more than 150 countries have been affected, with France, Mexico, and Italy being among the most impacted. The malicious firmware has been found not only in counterfeit phones but also in apps linked to the campaign's servers on the Google Play Store. Infected phones are sometimes sold under names like "S25 Ultra" or "i17 Pro Max," which are actually low-end MediaTek devices with no connection to Samsung or Apple. The two most common models are the S200 X from Doogee and the KINGKONG X from Cubot. Owners of these phones have reported a hidden package, com.Android.sys.*, on the XDA forum, which reappears under different names after being deleted. The firmware is signed with certificates under the name of the tablet manufacturer Shenzhen Zediel, although researchers have no proof of its involvement. It is unclear at which stage the malicious code is integrated, with possibilities including a firmware integrator or a logistics company. Once the phone is unpacked, the module cannot be removed through Android menus as it is installed in the system partition. Removing it would require cleaning the firmware or disabling the module via ADB, which most buyers are unable to do. The authors of the campaign have given the module access to accessibility services and SMS, which can be used to read the screen or intercept one-time codes sent by text. Researchers have observed no use of these permissions, but operators can activate them remotely. The system module does not display advertisements, but operators install fake weather or locking applications in the background, each equipped with a legitimate advertising kit. Ad networks then pay these applications for simulated impressions and clicks without the owner's interaction. According to Bitdefender, there are at least 32 such applications, which are installed and uninstalled in turn to remain as invisible as possible. Hackers apply the security marker designed for bank screens to their advertising surface, and the owner cannot capture or film it. Before each installation, they disable the Play Store, which hosts the Play Protect analyzer, then reactivate it once the operation is complete. They also falsify the declared source of the application, leading users to see a false mention of installation from Google Play.