Affected Systems

Low-cost Android smartphones with MediaTek chipsets, including Doogee S200 X, Cubot KINGKONG X, and Doogee Fire 3 Max. Thousands of devices affected across 150+ countries over two years, with highest concentrations in Mexico, France, Italy, US, Germany, Brazil, and Spain. Supply chain compromise introduced malicious firmware before retail distribution.

Exploitation Status

Active exploitation confirmed. Bitdefender researchers detected the 'Midnight Mimosa' campaign operating for approximately two years. Proxy C2 infrastructure confirmed operational and accepting device registrations. 13 related malicious apps also distributed through Google Play Store.

Business Impact

Organizations allowing employee-owned Android devices or issuing low-cost Android phones face risk of corporate network compromise through residential proxy functionality. Infected devices can relay attacker traffic, bypass network security controls, and access internal resources. System-level malware privileges prevent standard removal methods. Ad fraud activity generates network traffic anomalies and potential bandwidth costs. Devices may be used to mask origin of attacks against third parties, creating legal and reputational risk.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Audit all Android devices with MediaTek chipsets, particularly low-cost models from Doogee, Cubot, and unbranded manufacturers for suspicious system apps (com.android.system.lite, com.android.sys.prot, com.android.sys.gmsprot, com.android.non.szcz)
  • Block network traffic to Midnight Mimosa C2 infrastructure identified by Bitdefender at perimeter firewalls and monitor for connections from internal devices
  • Implement mobile device management (MDM) policies requiring device attestation and prohibiting devices that fail SafetyNet/Play Integrity checks from accessing corporate resources
  • Monitor network logs for unusual proxy behavior, unexpected outbound connections, and abnormal advertising SDK traffic volumes from Android devices
  • For confirmed infections, perform factory reset and restore older firmware versions if available from manufacturer, or replace devices if manufacturer has not issued clean firmware updates