Midnight Mimosa Malware Found Preinstalled on Budget Android Devices

A malware campaign known as Midnight Mimosa is being distributed via preinstalled firmware on low-cost Android devices, affecting users in more than 150 countries. According to SecurityWeek, the malicious software is baked into the system image before the devices reach consumers, making it difficult to remove through standard means.

The campaign primarily targets budget-oriented Android hardware. Unlike typical malware that is installed by users or downloaded from app stores, this threat is present at the factory level. This pre-baked nature means the malware is active from the moment the device is powered on for the first time. SecurityWeek reported that the scope of the distribution is extensive, with infected units found across a wide geographic range spanning more than 150 nations.

Firmware-Level Persistence

The defining characteristic of the Midnight Mimosa campaign is its integration into the device firmware. Because the malware resides in the system partition, it operates with high-level privileges. This persistence mechanism allows the malware to survive standard factory resets and system updates that would typically clear user-space infections.

According to SecurityWeek, the malware is not a separate application but part of the core operating system image provided by the device manufacturers or their suppliers. This method of distribution bypasses standard security checks that occur during the installation of third-party applications. The widespread nature of the campaign suggests a significant compromise in the supply chain or manufacturing process for these specific budget devices.

Global Scope and Device Types

The impact of this malware campaign is global, with SecurityWeek noting its presence in over 150 countries. The primary vector for infection is low-cost Android devices. These devices are often sold at price points that make them attractive to consumers in emerging markets or those seeking affordable technology.

The breadth of the geographic distribution indicates that the infected devices were likely produced in large volumes and exported widely. The targeting of budget devices suggests that attackers are exploiting lower security standards or less rigorous quality control processes often associated with cheaper hardware production. Users of these devices may be unaware that their systems are compromised, as the malware is hidden within the legitimate system files.

What should you do?

Security professionals and consumers should be aware that standard troubleshooting steps may not resolve firmware-level infections. Because the malware is part of the system image, removing it requires more than deleting apps or resetting settings.

What to do and how to stay safe: Midnight Mimosa

• Verify the source and reputation of the device manufacturer before purchasing budget Android hardware to reduce the risk of compromised supply chains.
• Monitor device performance and battery usage for anomalies that may indicate background processes associated with firmware-level malware.
• Check for official statements or security advisories from the device vendor regarding firmware integrity and known security issues.
• Once the vendor provides an update, apply system patches immediately, as vendor-supplied firmware updates are the only reliable way to remove pre-baked malware.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is Midnight Mimosa?

Midnight Mimosa is a malware campaign that is preinstalled on the firmware of low-cost Android devices, according to SecurityWeek.

How widespread is this malware campaign?

The malware has been found on devices in more than 150 countries, as reported by SecurityWeek.

Can I remove Midnight Mimosa with a factory reset?

No, because the malware is baked into the firmware, standard resets may not remove it; a vendor-provided firmware update is required.