> ## Content Index
> Fetch the complete content index at: https://www.privacyguides.org/llms.txt
> Use this file to discover other available public pages before exploring further.

# Thousand of Android Phones Shipped With Malware
- URL: https://www.privacyguides.org/news/2026/10/20/thousand-of-android-phones-shipped-with-malware/
- Published: 2026-10-20T21:24:18.000Z
- Updated: 2026-10-20T21:24:18.000Z
- Description: Researchers at Bitdefender discovered a malicious Android system application shipped by default in thousands of cheaper Android phones in more than 150 countries.
- Author: Fria Reyes
- Tags: News Briefs

Researchers at [Bitdefender](https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware) discovered a malicious Android system application shipped by default in thousands of cheaper Android phones in more than 150 countries.

The malicious applications were found on low-cost, MediaTek devices and were signed by the platform itself, meaning they could bypass normal Android security protections.

Dubbed "Midnight Mimosa," the attack relies on the `com.android.system.lite` component, which disguises itself as a legitimate OS component while "silently installing and removing applications without user interaction."

[Bitdefender](https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware) subsequently identified more malicious system components, all under a rotating set of names like `com.android.sys.prot` and `com.android.sys.gmsprot` . All share the same malicious core.

The component has the capability to delete and install applications without user interaction and has privileges related to Accessibility, Notifications, and SMS.

The malware pretends it is installed from Google Play despite lacking the proper signature, and disables the Google Play Store package and re-enables it after installing more malware onto the system, likely to bypass Google's [Play Protect](https://support.google.com/android/answer/2812853?p=playprotect%5Fdownload&hl=en-IN) antimalware system.

The installed malware connects to the command and control (C2) servers which provide advertising-fraud functionality to generate fake clicks and ad impressions through hidden windows and automated interactions.

 It can also install a residential proxy software to use your connection to relay other people's traffic through your device without your knowledge. The remote servers can constantly update the payload, making the compromise difficult to detect.

The attack might represent a severe supply chain compromise, although Bitdefender speculates some of the cheaper knockoff phone brands might have intentionally loaded the adware onto the phones in order to generate revenue. Platform-signed applications can have broad permissions and make detection difficult, since they can simply disable protections.

The scary part is that anyone who bought one of these phones would've been infected before they even turned their new phone on for the first time.

Bitdefender says some of the malware was signed by certificates from a company called "Shenzhen Zediel," but not whether this particular company knew about the malware or how their certificates ended up on the phones. Others that didn't have the Zediel-signed firmware that still shipped with the same malware.

> The malware ships with the device. What remains unclear is at which point in the supply chain it is integrated. It could be introduced by an ODM, a firmware integrator, a logistics partner, or another actor further down the distribution chain. The malware arrives in the ROM before the phone is sold, but identifying the specific party responsible for its inclusion requires information beyond the scope of this technical analysis.