Midnight Mimosa Firmware Malware Infects MediaTek Android Phones at Factory

Bitdefender researchers identified a firmware-level malware campaign called Midnight Mimosa that infects Android phones before owners activate the devices. The threat is embedded directly into the system software of low-cost devices built on MediaTek platforms, giving operators a persistent foothold that does not require users to click malicious links or install harmful applications.

The malware grants attackers the ability to install packages, remove existing apps, and load new code without requesting user permission. According to the report, this system-level access allows the operators to maintain control regardless of the user’s behavior, as the malicious component runs under Android’s system user and is signed with a platform certificate. This delivery method places the vulnerability within the device supply chain rather than attributing it to end-user error.

Technical Operation and Detection

Bitdefender’s App Anomaly Detection technology flagged the threat by identifying a system package labeled “System” that behaved unlike normal Android components. This hidden component could not be removed through the phone’s standard uninstall controls, ensuring its persistence. During startup, the malware hides much of its code in a native library, which decrypts an embedded APK using RC4 encryption to load a hidden Java framework.

This framework then downloads additional DEX and JAR modules to modify the phone’s behavior after purchase. These modules handle tasks such as generating fake advertising clicks, installing unauthorized apps, and facilitating further downloads. Some of these JAR files are stored with object-file extensions, while downloadable modules are disguised as PNG image files to evade detection.

Global Distribution and Affected Devices

The detailed malware research report by Bitdefender, published on October 8 and updated on October 9, describes thousands of affected devices across more than 150 countries during a roughly two-year observation window. Mexico, France, and Italy led the observed distribution of infected devices, followed by the United States, Germany, Brazil, and Spain. These findings reflect Bitdefender’s specific visibility into the threat and do not represent a complete global infection count.

Some infected phones reported counterfeit flagship names, meaning their model labels cannot reliably identify the actual hardware or manufacturer. This obfuscation complicates efforts to determine which specific brands or models are compromised. Earlier cases involving preinstalled Android firmware malware demonstrate why reviewing downloaded apps alone is insufficient for protecting devices that contain trusted but harmful system components when they leave the seller.

What should you do?

The primary risk stems from the device hardware and firmware rather than user-installed software. Since the malware is embedded at the system level, standard security practices like avoiding suspicious links or checking app permissions do not mitigate this specific threat. Users of low-cost MediaTek-based Android devices should be aware that their system integrity may have been compromised before first use.

Background: Firmware malware

Firmware malware infects the low-level software that initializes hardware before the operating system loads. Because it operates outside the OS, traditional antivirus tools often miss it. Detecting it requires analyzing boot processes and using specialized firmware verification tools, while removal usually involves reflashing the firmware with a known good image.

Read the full guide: Firmware Malware: How to Detect and Remove Persistent Threats

What to do and how to stay safe: Midnight Mimosa

• Verify the authenticity of your device manufacturer and model, as counterfeit labels may indicate compromised hardware supply chains.
• Monitor for unusual battery drain or data usage, which can signal background processes associated with fake ad clicks or proxy services.
• Check for unknown system apps or packages with elevated permissions that cannot be uninstalled through standard settings.
• Wait for vendor updates or firmware patches that address known supply-chain vulnerabilities, as no immediate fix has been confirmed for all affected devices.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does Midnight Mimosa infect Android phones?

The malware is embedded directly into the device firmware of low-cost Android phones built on MediaTek platforms, infecting them before users turn them on.

Can users remove Midnight Mimosa using standard uninstall methods?

No, the malware runs as a system component signed with a platform certificate, preventing removal through the phone’s normal uninstall controls.

What are the main goals of the Midnight Mimosa operators?

The operators use the malware to generate revenue through fake advertising activity and to establish residential proxy services using the infected devices.