Midnight Mimosa Malware Turns Cheap Android Phones Into Proxy Botnets
Researchers say preinstalled malware on low-cost Android devices enables ad fraud and creates hidden proxy networks across 150 countries.
Key points
- Malware is embedded in device firmware before purchase, bypassing standard app installation checks.
- Bitdefender observed thousands of infected devices across more than 150 countries over two years.
- The campaign uses platform-signed system apps to install plugins and evade Google Play Protect.
Bitdefender reports that the Midnight Mimosa campaign is turning inexpensive Android smartphones into advertising fraud engines and potential residential proxy nodes. The threat actors embed malicious applications directly into device firmware before the hardware reaches consumers, creating a compromise that persists even after the owner attempts to remove apps.
This widespread infection was observed across more than 150 countries over approximately two years. According to Bitdefender, the campaign affects thousands of devices, including low-cost handsets based on MediaTek chips and counterfeit flagship models. The persistence of the malware stems from its integration into the operating system rather than a user-installed application.
Technical Operation and Evasion
The initial enabler, identified as com.android.system.lite, impersonates a legitimate operating system component while retaining powerful system permissions. These include INSTALL_PACKAGES, DELETE_PACKAGES, GRANT_RUNTIME_PERMISSIONS, and WRITE_SECURE_SETTINGS. These privileges allow the malware to install applications, remove packages, grant permissions, and alter protected settings without requiring any user interaction.
The concealed functionality resides in libeasy.so, a native library that uses RC4 encryption to decrypt an embedded Java framework. This framework retrieves remote configuration data and downloads DEX or JAR plugins from command infrastructure. According to Bitdefender, operators use domains such as api.weatherlive.world and oss.showtimetool.com to retrieve these modules. The weather-themed naming helps the malicious traffic resemble routine application communications.
Impact and Specific Modules
Before deploying payloads, the enabler temporarily disables the Google Play Store package and then restores it. Bitdefender assesses this behavior as an attempt to evade detection by Google Play Protect. Although sensitive access mechanisms exist within the malware, researchers did not observe active abuse of the associated permissions during their analysis.
Specific plugins drive the campaign’s activities. The com.wz.sdk.DxFactory module handles fraudulent advertising activity. Meanwhile, com.earnsdk.lib.DxFactory and com.gogo.third.lib.DxFactory support the silent installation and removal of applications. Researchers identified at least 32 disguised applications within the payload ecosystem. These include weather tools, application lockers, OCR utilities, and file managers that fabricate impressions and clicks.
What should you do?
Security professionals should monitor network traffic for connections to known command-and-control domains associated with this campaign. Organizations should verify the integrity of device firmware, particularly on low-cost or gray-market Android handsets. Users should be advised that standard application removal may not resolve this type of firmware-level compromise.
What to do and how to stay safe: Midnight Mimosa
- Inspect network logs for outbound connections to domains such as api.weatherlive.world or oss.showtimetool.com, which are linked to this malware’s infrastructure.
- Verify that Android devices, especially those from low-cost manufacturers or unofficial channels, have not been modified at the firmware level before deployment.
- Monitor for unexpected system-level permission changes or the silent installation of apps that impersonate utilities like weather tools or file managers.
- Assume that standard app uninstallation is ineffective for this threat; consider reflashing the device with verified, clean firmware if infection is suspected.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Midnight Mimosa?
It is an Android malware campaign that embeds malicious apps in device firmware to enable ad fraud and create proxy botnets.
How does the malware avoid detection?
It uses a platform-signed system app to gain high privileges and temporarily disables Google Play Store to evade Play Protect checks.
Can I remove this malware by uninstalling apps?
No, because the malware is embedded in the firmware and operates as a system component, ordinary application removal cannot resolve the compromise.
