A newly discovered malware campaign dubbed “Midnight Mimosa” infects budget Android phones even before users power them on. Hidden in device firmware on smartphones built using MediaTek chipsets, this malware bypasses traditional attack vectors like malicious apps or phishing links. The firmware-level infection grants the malware ongoing control over the device’s system.
Researchers at Bitdefender uncovered Midnight Mimosa when routine monitoring flagged a system package behaving unlike standard Android system components. The campaign has impacted thousands of devices across over 150 countries over nearly two years. Mexico, France, and Italy saw the most infections, followed by the United States, Germany, Brazil, and Spain. Experts caution the figures represent what Bitdefender could observe, not the full scale globally.
How the Infection Runs Beneath the Surface
The malware includes a component masquerading as a system-level package, signed with a platform certificate, that gains high privileges under Android’s system user. It installs or removes apps and grants permissions silently, outside of user control. Because it’s embedded in firmware, conventional uninstallation tools are ineffective. The infection likely originates in the device’s supply chain rather than originating from user actions.
Midnight Mimosa’s core is a native library that, during startup, decrypts a built-in APK using RC4. From there it loads a hidden Java framework which then fetches additional modules in DEX and JAR formats. These modules enable malicious behaviors including ad fraud, silent app installs, and new payloads. To further conceal activity, some modules arrive disguised as PNG files, while others are stored under names like object-files.
Fraud, Proxies, and Control
Bitdefender cataloged at least 32 deception apps tied to the campaign—weather tools, file managers, and app lockers, among others. These apps rotate: some are silently installed or removed so the visible apps change, but the firmware infection endures. Ad fraud powers much of the scheme by triggering impressions and clicks without user involvement, often using timing strategies to mimic normal use patterns.
In addition to advertising fraud, Midnight Mimosa contains proxyware functionality. A fake app locker payload can convert devices into residential proxies, rerouting traffic through the infected phone. While tests didn’t confirm active proxy traffic during controlled experiments, researchers determined the capability was built in. To avoid detection, the malware repeatedly disables the Google Play Store package, re-enables it when users engage with the device, and sometimes forges installer claims tying back to Play Store—despite lacking valid Google signatures.
In several firmware samples, certificates labeled with ‘‘Shenzhen Zediel’’ were observed, though Bitdefender has not confirmed whether that company knowingly participated. Exactly where the malware enters the supply chain remains unknown. Because of its firmware basis, removing Midnight Mimosa requires interventions at that level—normal uninstalls and regular security tools are inadequate. Vendors and retailers hold key responsibility for addressing affected phones.
The report also corrects earlier findings about one network address linked to proxy control: it is now classified as a sinkhole rather than verified attacker infrastructure.
Indicators of compromiseinclude control endpoints like “api.weatherlive[.]world/br_upgrade/upgradeV2/getConfigs” for module configs, module hosts such as “oss.showtimetool[.]com” delivering payloads disguised in PNGs, and certain MD5 hash signatures for core native libraries and APKs like “libeasy.so” or files under names like “com.android.system.lite”.
What this reveals:Midnight Mimosa expands the frontlines of Android malware. It shifts the battleground from risky apps in the Play Store or phishing links to the firmware layer, where traditional protections rarely reach. For owners of budget devices—those built on MediaTek platforms in particular—this campaign demonstrates the limitations of relying solely on app-based security tools. Better firmware auditing, tighter control of the supply chain, and clearer responsibilities for vendors and sellers are now more essential than ever.
