Reports reveal that over thousands of Android phones across more than 150 countries have shipped out of the box with malware baked into the firmware. Named “Midnight Mimosa,” the discovery impacts low-cost and counterfeit devices and allows root-level attacks without any action on the user’s part. Security researchers identified this hidden threat in a study published on October 19, confirming its presence in devices from Mexico, France, Italy, the US, Germany, Brazil, Spain and elsewhere.
How Midnight Mimosa Operates
Unknown to users, a system application signed with an Android platform certificate is implanted in the firmware. Because it’s trusted by the operating system, it gains sweeping permissions: installing or removing apps, changing protected settings and enabling powerful access features. Key routines of the malware are hidden inside a native library that decrypts—via RC4—a disguised Java framework that can reach out to command-and-control servers. From there, payloads like DEX or JAR plugins are fetched, which shape the malware’s behavior. Some modules deliver silent app installations; others conduct ad fraud through hidden windows and automated clicks. Researchers spotted these disguised apps masquerading as everyday tools like file managers, app lockers, weather apps and scanners. At least 32 such cloaked apps were cataloged in the campaign’s infrastructure.
Evasion, Permissions, and Potential Risks
One striking tactic: pressing pause on Google Play Store’s protection long enough to slide malicious software in, then restoring it to minimize detection. Some apps falsely claim to have been installed via the official Play Store yet lack its digital signature. Beyond ad-fraud and stealth installs, there’s evidence the malware can impersonate privileged roles via Accessibility, Notification Access and SMS permissions. While these have not (yet) been used to steal private data in analyzed samples, the possibility is open due to the dynamic nature of fetched code.
Additionally, the malware includes proxy capabilities that allow an infected device to open two-way TCP tunnels—potentially serving as a relay for other malicious traffic. Though no network abuse was confirmed during analysis, servers and domains tied to these operations were identified. The devices found infected include various low-cost MediaTek phones, counterfeit high-end models, and specific brands like Doogee and Cubot. Some firmware certificates bear association with an entity called Shenzhen Zediel. It remains unclear at what point in the supply chain the malware was inserted and whether the certificate holder was involved knowingly.
What to Look Out For
Researchers published indicators of compromise including package names like com.android.system.lite (the initial enabler), com.mobile.applock.en (proxy payload), native library name libeasy.so, and plugin classes such as com.wz.sdk.DxFactory tied to ad intelligence or app manipulation. Domains used for control traffic include api.weatherlive[.]world and module download hosts like oss.showtimetool[.]com. These markers may help security tools spot infections early.
This threat doesn’t stem from downloaded apps but from malicious code already installed in system firmware. Traditional defenses that focus only on app store behavior may miss the root cause. While Google’s protective tools do scan for app threats and check devices periodically, this case shows trusted system components need rigorous verification too.
Midnight Mimosa aligns with earlier reports about invisible malware embedded in Android firmware. Researchers first observed evidence of such abuse around two years ago; this investigation combines those with fresh findings compiled by Bitdefender and PolySwarm from 2024-2026. Low hardware cost, opaque supply chains, and weak oversight create fertile ground for firmware-level malware to spread.
What this means in practice: a phone you buy might already be compromised. Even uninstalling visible malicious apps won’t be enough—you’ll need firmware-level fixes, full certificate audits or device replacement in many cases. Consumers buying budget phones should review security track records and possibly avoid brands with opaque sourcing. For security teams, this threat underlines the importance of monitoring firmware integrity and incorporating firmware IoCs into threat intelligence. The battle for Android security is quietly shifting deeper than just apps—into the firmware itself. Expect more disclosures like this unless supply chains become transparent and firmware auditing becomes standard practice.
