Bitdefender Uncovers Midnight Mimosa Malware on MediaTek Android Devices

Bitdefender Labs researchers have identified a new malware campaign dubbed Midnight Mimosa that compromises Android devices before users even turn them on. The threat actors have pre-installed this malicious software on low-cost, multi-brand smartphones, creating a supply-chain risk that bypasses initial user security checks and device boot processes.

According to the security firm, the campaign specifically targets Android devices built on MediaTek platforms. These low-cost phones often originate from various manufacturers, making it difficult for consumers to identify the risk based on brand reputation alone. The malware is embedded in the device firmware or system image, meaning it is present from the moment the hardware is manufactured or assembled.

Supply Chain Compromise Mechanics

The term Midnight Mimosa describes the specific operation where threat actors inject malware into the supply chain of inexpensive mobile devices. By targeting the manufacturing or distribution phase, the attackers ensure the software is deeply integrated into the operating system. This method allows the malware to persist even if the user performs a factory reset, as the infection resides in the system partition rather than the user data partition.

Bitdefender’s analysis highlights the rise of this technique in the market for budget-friendly smartphones. The use of MediaTek platforms suggests the attackers are exploiting the widespread adoption of these chipsets in entry-level devices. The multi-brand nature of the affected devices indicates a broad distribution network, potentially involving unauthorized refurbishers or specific manufacturing batches that were compromised before reaching retail shelves.

Affected Devices and Platforms

The primary victims of this campaign are users who purchase low-cost Android smartphones. Because the devices come from multiple brands, the threat is not isolated to a single manufacturer’s product line. The common denominator is the underlying hardware architecture, specifically the MediaTek platform used in many budget devices globally. This widespread hardware usage amplifies the potential attack surface for the Midnight Mimosa campaign.

Users of these devices may unknowingly install compromised phones that already contain active malware. The infection occurs prior to the first boot, which means standard security scans performed after setup might not detect the root cause if they do not check system-level integrity. The lack of a single brand association makes it challenging for consumers to avoid the threat without specific model warnings from security vendors.

What should you do?

Security professionals should monitor for unusual network traffic originating from newly provisioned devices on their networks. Organizations deploying mobile devices should verify the integrity of the firmware and system images before issuing them to employees. Individual users should be cautious when purchasing low-cost smartphones from unofficial channels, as these are more likely to be part of compromised supply chains.

What to do and how to stay safe: Bitdefender

• Verify the source of low-cost Android devices and avoid purchasing from unofficial or gray-market retailers.
• Check for firmware updates from the manufacturer that may address known security vulnerabilities in the system image.
• Monitor device behavior for unusual background processes or network connections that do not correspond to installed applications.
• Use mobile security software that can perform deep system scans to detect anomalies in the operating system partition.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is Midnight Mimosa?

Midnight Mimosa is a malware campaign identified by Bitdefender Labs that involves pre-installing malicious software on Android devices.

Which devices are affected by this malware?

The malware affects low-cost, multi-brand Android devices that are built on MediaTek platforms.

When does the infection occur?

The infection occurs before the user turns the phone on, as the malware is pre-installed during the manufacturing or distribution process.