Bitdefender Discovers Midnight Mimosa Malware Preinstalled on MediaTek Android Phones

Bitdefender researchers have uncovered a widespread Android malware campaign named Midnight Mimosa that is preinstalled on low-cost smartphones. According to Security Affairs, the malicious software is embedded directly into the device firmware of phones utilizing MediaTek platforms. This integration allows the malware to persist on the device even after factory resets, creating a persistent security risk for users of these specific hardware configurations.

The campaign affects devices from various brands that rely on MediaTek chipsets for their core processing capabilities. Security Affairs reports that the malware is not an app installed by the user but is built into the system image before the device reaches the consumer. This firmware-level installation means standard uninstallation procedures are ineffective, as the malicious code operates with high-level system privileges that typical user accounts cannot override.

Malware Capabilities and Behavior

Once active, the Midnight Mimosa malware executes several disruptive and monetizable tasks without the user's consent. According to the report by Security Affairs, the primary function of the malware is to generate fraudulent ad clicks, which generates illegitimate revenue for the threat actors behind the campaign. This activity consumes device resources and data bandwidth while potentially skewing advertising metrics for legitimate businesses.

Beyond ad fraud, the malware has the capability to drop additional applications onto the infected devices. Security Affairs notes that the software can install other apps silently, further cluttering the device and potentially introducing secondary threats. Additionally, the malware builds a proxy botnet, turning the infected smartphones into nodes that can be used to mask the identities of other malicious actors or route illegal traffic through the compromised devices.

Geographic Spread and Device Affected

The scope of the Midnight Mimosa campaign is significant, with evidence of infection found across 150 countries. Security Affairs highlights that the malware targets low-cost phones, which are popular in emerging markets where price sensitivity often leads consumers to purchase devices from lesser-known manufacturers. These budget devices frequently use MediaTek platforms due to their cost-effectiveness, making them a prime target for this specific supply-chain-style attack.

Because the malware is preinstalled, users are infected from the moment they power on their devices. This differs from typical malware infections that require user interaction, such as clicking a malicious link or downloading a compromised app. The reliance on MediaTek platforms suggests that the compromise may have occurred during the manufacturing or firmware distribution process, affecting multiple brands that source components or software builds from the same ecosystem.

What should you do?

Security professionals and affected users should monitor devices for unusual battery drain or data usage that may indicate background botnet activity. Since the malware is firmware-based, standard security scans may not detect or remove it effectively. Users of low-cost MediaTek phones should verify the integrity of their device software and check for official firmware updates from the manufacturer, though no fix has been confirmed yet.

What to do and how to stay safe: Bitdefender

• Monitor device performance for unexplained battery drain or excessive mobile data usage that could indicate background botnet or ad-clicking activity.
• Verify the authenticity of the device manufacturer and check for any official firmware updates that might address preinstalled software issues.
• Avoid installing additional third-party applications on devices suspected of being infected, as the malware may have the capability to drop further malicious apps.
• Report suspicious device behavior to the manufacturer and relevant cybersecurity authorities to help track the spread of the firmware-level compromise.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Can I uninstall the Midnight Mimosa malware?

No, because the malware is built into the device firmware, standard uninstallation methods are ineffective according to Security Affairs.

Which devices are affected by this campaign?

Low-cost Android phones that use MediaTek platforms from various brands are affected by the preinstalled malware.

How widespread is the Midnight Mimosa campaign?

The malware has been seen in 150 countries, indicating a global distribution of the compromised devices.