A malicious campaign called Midnight Mimosa has compromised thousands of budget Android devices across more than 150 countries, including Brazil. The malware comes pre-installed in the device firmware, meaning users have no way to detect or remove it through normal means.
The infected phones are being weaponized in multiple ways. The malware can install additional malicious applications without user consent, and it transforms compromised devices into residential proxies—using the phone owner's internet connection to route and disguise third-party traffic. This turns innocent users into unwitting accomplices in cyberattacks or other illicit activities.
Among the affected models are the Doogee S200 X and Cubot KINGKONG X. The exact point of compromise remains unclear—whether the malware was injected during manufacturing, in the supply chain, or at distribution remains unknown. The identity of those responsible has also not been determined.