Midnight Mimosa malware comes preinstalled on low-cost MediaTek Android phones

Bitdefender has discovered and analyzed a campaign dubbed Midnight Mimosa, in which malware comes preinstalled in the firmware of low-cost Android devices built on MediaTek platforms. The infection is persistent, runs as a pre-installed firmware system app, and can’t be removed through normal uninstall procedures. Anyone who switches on an affected device finds the malware already present, unseen, and available to any bad actor who can control it remotely through its command-and-control (C2) server.

There’s a large global market for low-cost Android devices, and the attackers behind Midnight Mimosa are servicing that demand with compromised hardware.

What the malware can do

The potential scale of this kind of C2-controlled infection is substantial. Bitdefender’s report states: “The malware runs with system-level privileges that allow it to silently install and remove apps, grant permissions, and load arbitrary code supplied remotely. This essentially means its operators could install and delete apps at will, tuning each device to their needs, including making them part of large botnets.”

Midnight Mimosa focuses on ad fraud, automated click fraud, and turning each device into one small component of a much larger botnet. That makes sense for a campaign trying to stay under the radar with an army of infected devices: many thousands of fraudulent clicks over time would give any bad actor a healthy return on investment, and botnets are described as a hot commodity that can be rented out to other attackers – the bigger the botnet, the bigger the bounty.

Reach and scale

Over the past two years, Bitdefender has observed thousands of unique affected devices across more than 150 countries, with no single country or region dominating distribution. Mexico and France lead, followed by Italy, the US, Germany, Brazil, and Spain, with Western Europe and the Americas standing out regionally. The report doesn’t indicate how much money Midnight Mimosa’s operators have actually made, but it does include an extensive list of indicators of compromise (IoCs) to help prevent further infections.

Google Play apps and Play Protect evasion

Bitdefender also found 13 apps on Google Play, spread across two developer accounts with separate signing certificates, that contained the same Midnight Mimosa ad-fraud code. As the researchers put it: “The campaign is not confined to preinstalled firmware. Thirteen applications published on Google Play were found carrying the same family markers as the dropped cover apps, in builds distributed by Play itself.” Those Play Store apps don’t have the same privileged access as the preinstalled malware, but they’re considered part of the broader ecosystem, giving attackers an additional distribution channel.

Whether preinstalled or loaded from Google Play, the malware has been seen disabling the Play Store before installing additional payload applications, then re-enabling it afterward, probably to avoid detection by Play Protect. The researchers note: “Beyond suppressing the install prompt, the plugins blind Google Play Protect for the duration of the install. The malicious install happens in a window where Google’s scanner is switched off.”

Bitdefender’s researchers describe Midnight Mimosa as best understood as a supply-chain threat, where malware is largely integrated into an Android device before it’s sold. The campaign is characterized by preinstalled persistence, system-level control, ad-fraud activity, proxy-network abuse, and remote payload management, giving attackers extensive control over affected devices from the very beginning.