It Survives a Factory Reset — The App Sewn Into the Lining of a Half-Price 'Ultra' Phone

The Day You Bought a Half-Price Designer Jacket

Say you bought a padded jacket from an online marketplace. There’s a famous brand logo on the chest. The price is less than half of retail. You try it on and it’s warm, and it looks fine from the outside.

But what if somebody at the factory had sewn something into the lining of this jacket? You can’t see it from the outside. No matter how many times you run it through the washing machine, the stitching inside the lining stays right where it is. To get it out, you’d have to rip the lining open and sew it back up. That isn’t something an ordinary person can do at home.

The report that came out this week is a story about exactly this kind of garment. Except it isn’t a garment — it’s a smartphone.

What Is Happening

You take a new phone out of the delivery box. The box says ‘S25 Ultra’. You power it on for the first time and link your account. Nothing happens up to this point.

A few days later, strange things start. Ads pop up on the screen even though you haven’t opened any app. Icons for apps you never installed appear and then disappear. When you go into Settings to delete them, they’re ‘system apps’, so there’s no uninstall button.

FACT The security firm Bitdefender gave this malware the name ‘Midnight Mimosa’. The code was inside the phone’s firmware. Firmware is the basic program that runs first when the phone powers on. It’s put onto the phone at the factory before shipping. So it was already installed before the owner ever pressed the power button.

In jacket terms, it’s like this. It isn’t a stain the buyer caused by wearing it wrong. It was sewn into the lining in advance, at the factory.

Who Is Affected

FACT The infected devices were mostly low-cost or counterfeit products sold through online marketplaces. The cases in the report fall into three broad groups.

• Knockoff phones mimicking the Samsung name. They carried names like ‘S24 Ultra’, ‘S25 Ultra’, ‘S26 Ultra’, and ‘Note 18 Ultra’.
• Knockoff phones mimicking the iPhone name. These had names like ‘i16_Pro_Max’, ‘i17 Pro Max’, and ‘17_Pro_Max’.
• Low-cost rugged phones such as the Doogee S200 X and the Cubot KINGKONG X. A rugged phone is a tough phone built thick so it doesn’t break easily when dropped.

FACT One knockoff phone was using the exact model code of a genuine Galaxy S25 Ultra. And yet it was not a Samsung product. It was a garment that copied not just the logo but even the label on the inside.

This also covers cases where you bought a phone like this as a ‘second phone’ for a parent or a child.

Why It Works — A Spot the Delete Button Can’t Reach

Normally, when something is wrong with a phone, we do two things. We delete the suspicious app. If that doesn’t work, we do a factory reset. Neither of those works this time.

FACT This malicious app sits in the system partition. The system partition is where the basic apps the phone needs in order to run are stored. Apps here have higher privileges than the phone’s owner. That’s why they can’t be removed by ordinary means.

FACT The researchers concluded there are only two routes to getting rid of it. You either clean up the firmware wholesale, or you disable it via ADB. ADB is a tool for connecting the phone to a computer and handling it with developer commands. The researchers wrote that this is not realistic for most users.

INFERRED A factory reset is a feature that returns the phone to ‘the original state it came in from the factory’. But that original state already had the malicious app in it. So a reset only takes you back to a state where the malicious app is present. It’s the same as the stitching inside the lining never coming out no matter how many times you run the washing machine.

FACT It has been reported that some manufacturers released updates fixing this problem. That said, no manufacturer has publicly explained how the infection happened. It has also been reported that there are user reports of a phone becoming infected again after the malware was manually removed and the phone then received an official manufacturer update (a post on the XDA forums by a Doogee Fire 3 Max user). This case appears only in the BleepingComputer article, and we were not able to check it against the primary source.

It’s the story of taking the jacket to a tailor, getting the lining fixed, and finding the same thing sewn into the new lining sent from the same factory. It isn’t a confirmed event yet. But it is reason enough not to relax at ‘it can just be fixed’.

What It Does Inside the Lining

FACT With system privileges, this app can do the following without the owner knowing.

• Installs and deletes other apps. At least 32 kinds of disguised apps were confirmed.
• Grants permissions to apps. Normally this is something the owner has to tap “Allow” for.
• Executes code received remotely. Meaning it downloads new instructions from outside and runs them as given.

FACT Right before it secretly installs an app, it briefly disables the Google Play Store. The point is to keep the app being installed from being scanned. Once installation finishes, it turns it back on. Some variants also fake the origin so the app looks like it was downloaded from Google Play.

FACT The visible symptom is ads. This app displays ads in hidden windows and clicks them itself. This is called ad fraud. It’s a technique for skimming ad money by faking the appearance that a person saw an ad and clicked it. Ads popping up outside of any app is also because of this.

FACT Inside an app disguised as an app-lock tool, there was also a proxy function. This function registers the phone as a ‘relay node’. Put simply, it signs your phone up as a relay that other people’s internet traffic goes out through. Then, from the outside, that connection looks like it came from your phone.

FACT That said, no instruction to relay ever arrived on the researchers’ test phone. So whether it actually passed along anyone else’s traffic was not confirmed. It means the registration was in place, but we don’t know whether it did any work.

FACT The malicious app’s configuration file listed accessibility, notification access, and SMS permissions. Accessibility permission is a powerful permission originally meant for things like features that read the screen aloud for you. But the researchers did not observe any behavior that used this permission to extract information. So we can’t say that it “steals banking information”. The state of things is: it holds the key, but we haven’t yet seen it open the door.

The Scale, in Numbers

FACT The last row is worth pointing out separately. The 13 Play apps don’t have system privileges. Even so, they can display ads outside of the app. They were up on Play at the time the report was written. To use the jacket comparison, the same thing was in an accessory sold in the pocket rather than inside the lining.

FACT The report does not mention any infection cases in South Korea. Whether South Korea is among the 150-plus countries also can’t be determined from the report alone.

What To Do Now

There are two things to do. One is before you choose, one is for after you’ve already bought.

1. Filter it out at the checkout Don’t buy a phone labeled ‘Galaxy Ultra’ or ‘iPhone Pro Max’ that is strangely cheap. Buy through official distribution channels. Stitching inside the lining is hard to rip out once you’ve brought it home. So filtering the garment out at the checkout is the easiest approach.

2. If you’re already using one — keep anything important off that phone Don’t log in to important accounts like your bank or your main email on that phone. And check whether a manufacturer firmware update has been released.

INFERRED No information-extracting behavior was observed. Even so, this phone can execute code received remotely. That means it can be made to do tomorrow what it isn’t doing today. So it’s safer to keep important accounts on a different phone from the start.

If You Suspect Your Phone — These Are the Signs

• Ads appear even when you aren’t using any app.
• Apps you never installed repeatedly appear and disappear.
• There are entries in your app list that look like system apps but that you can’t identify.
• The model name says Samsung or Apple, but you bought it somewhere other than an official manufacturer retailer, far below market price.

The last item isn’t a symptom. Even so, it’s the one of the four you can check first. Because you can tell just by looking at the receipt.

What We Don’t Know

This article is a relay of somebody else’s investigation. Much of it has not been established yet. We’re writing this out separately so as not to pretend to know.

• We don’t know whether it spread to South Korea. Whether there are infected phones in South Korea, and whether the same models were sold on domestic open marketplaces or via overseas direct purchase, has not been confirmed.
• We don’t know whether your phone was actually used as a relay. The researchers also could not confirm that anyone else’s traffic passed through. We cannot state flatly that “my phone was used for a crime”.
• We don’t know whether personal information was extracted. SMS, notification, and accessibility permissions were declared. But no behavior extracting personal information or verification codes was observed.
• There is nothing about battery or data usage. The report contains no diagnostic rule along the lines of “if your battery drains fast, you’re infected”.
• We don’t know who planted it, or at which stage. The certificate used to sign the firmware is said to link to a company in Shenzhen, China. But whether that company was involved is unclear. We are not treating this as the work of a particular country or company.
• We don’t know whether the 13 Play apps are still up. Whether they were removed has not been confirmed.
• There is no list of which manufacturer fixed which model. It has been reported that some released fix updates, but no specific list was given.

Not confirmed: whether there was infection in South Korea, whether traffic was actually relayed, whether information was stolen, the reinfection-after-official-update case (a user report in one overseas article).

Sources

• Bitdefender Labs (primary source, 2026-10-08) — The phone was compromised before the user turned it on: the rise of Midnight Mimosa https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
• BleepingComputer (2026-10-08) — Low-cost Android phones ship with residential proxy malware https://www.bleepingcomputer.com/news/security/low-cost-android-phones-ship-with-residential-proxy-malware/

This article was written on the basis of the two sources above, as of 2026-10-10. It is a summary of outside research, not something our honeypot observed. So there are no IPs to mask and no credentials to quote. The BleepingComputer article was checked against the original Bitdefender report. Items we could not check against the report are marked in the body with “it has been reported”. Commands, addresses, and installation procedures that would let someone copy the attack, along with the names of the malicious apps, have been deliberately left out.