Midnight Mimosa Android Malware Compromises Firmware of MediaTek Phones
Researchers disclosed that the Midnight Mimosa campaign infected thousands of devices across 150 countries by embedding malicious code directly into device firmware.
Key points
- Midnight Mimosa arrived pre-installed on devices, bypassing standard download protections and granting attackers deep system privileges.
- The malware generates revenue through ad fraud and residential proxy services, affecting primarily inexpensive MediaTek-based phones.
- Bitdefender researchers identified the campaign on October 8, noting it operated for roughly two years across more than 150 nations.
Bitdefender researchers disclosed on October 8 that the Midnight Mimosa malware campaign had been active for approximately two years. This operation compromised thousands of Android smartphones by embedding malicious code directly into the device firmware before the hardware reached consumers.
The campaign primarily targeted inexpensive phones built on MediaTek platforms. Unlike typical malware that requires a user to download a malicious application, this threat arrived pre-installed on the hardware. This supply-chain infection method allowed the malware to operate with high-level system privileges from the moment the device was powered on.
Technical Mechanics and Evasion
The malware utilized several package names that mimicked legitimate Android components, such as com.android.sys.prot and com.android.sys.gmsprot. Researchers noted that these names were designed to blend in with standard system processes. However, analysts identified shared malicious functionality across these variants rather than relying on specific package names for detection.
A native library called libeasy.so decrypted a hidden framework that retrieved remote configuration instructions. This infrastructure masqueraded as a weather service to avoid suspicion. The malware also used misleading file extensions, such as labeling JAR components as .o files and APK payloads as .png images, to complicate static analysis and evade initial security inspections.
Ad Fraud and Proxy Revenue
Bitdefender’s investigation began when behavioral detection flagged an iconless package labeled “System.” The researchers identified at least 32 dropped applications disguised as useful tools, including weather apps, file managers, and note utilities. These cover applications loaded genuine advertisements through legitimate advertising services while hidden windows generated impressions without any visible user engagement.
Additional components generated synthetic clicks to convert this covert activity into revenue. The malware also functioned as a residential proxy service, allowing attackers to route traffic through the compromised devices. Before installing certain payloads, the malware temporarily disabled the Google Play Store package to evade Play Protect checks, further demonstrating its ability to manipulate system permissions.
Who Is Affected
The geographic distribution of infected devices was led by Mexico, France, and Italy. The United States, Germany, Brazil, and Spain also appeared frequently in the data. Researchers did not observe any evidence that MediaTek introduced the infection or that the chipmaker was responsible for the supply-chain breach. The entry point for the hardware compromise remains unknown.
The malware repeatedly manipulated permissions for Accessibility, Notification Access, and SMS. However, researchers stated that they did not observe the abuse of notification or SMS privileges. This suggests that while the capability for surveillance existed, the operators may have focused primarily on financial gain through ad fraud and proxy services rather than data theft.
What should you do?
Security professionals should monitor for unusual system processes that mimic legitimate Android components. Organizations managing fleets of inexpensive Android devices should verify firmware integrity and watch for unexplained battery drain or data usage indicative of proxy activity.
What to do and how to stay safe: Midnight Mimosa
- Inspect installed applications for unknown system-level packages or apps with generic names like "System" that lack recognizable icons.
- Monitor network traffic for connections to suspicious domains or services that masquerade as legitimate utilities like weather applications.
- Verify that device firmware matches the official vendor release, especially for inexpensive phones sourced from less common manufacturers.
- Watch for unexpected permissions requests for Accessibility or SMS, and disable them immediately if they originate from unknown applications.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this malware affect all Android phones?
No, the campaign primarily affected inexpensive phones built on MediaTek platforms, though the exact supply-chain entry point remains unknown.
Is MediaTek responsible for the malware?
No, researchers did not establish that MediaTek introduced the infection, and the source of the supply-chain compromise remains unidentified.
How does Midnight Mimosa generate revenue?
The malware generates revenue through advertising fraud using hidden windows and synthetic clicks, as well as by operating as a residential proxy botnet.
