[CLSTR]
< Back to all clusters
[TECHNOLOGY] · Mexico, France, Italy, United States, Germany · 20 sources

started · updated

Part of situation: Midnight Mimosa Android firmware malware (2 clusters)

Midnight Mimosa malware found preinstalled on low-cost Android phones

Midnight Mimosa Android malware firmware infection ad fraud proxyware

Bitdefender researchers have identified a widespread malware campaign named Midnight Mimosa that is preinstalled in the firmware of low-cost Android devices. The infection occurs at the manufacturing or supply chain level, meaning the devices are compromised before they are even unboxed and powered on.

Targeting primarily budget smartphones and counterfeits using MediaTek chipsets—including models from brands like Doogee and Cubot—the malware operates with deep system-level privileges. This allows it to bypass standard security measures, such as Google Play Protect, by temporarily disabling the Google Play Store during malicious installations. Once active, the malware can silently install or remove applications, grant permissions, and execute remote code without user interaction.

The primary objective of the campaign appears to be financial monetization. The malware uses fake applications, such as weather tools or file managers, to generate fraudulent ad clicks and impressions. Additionally, it can transform infected devices into residential proxies, using the user's internet connection to relay third-party traffic. The campaign has been observed affecting thousands of devices across more than 150 countries over the last two years, with significant activity reported in Mexico, France, Italy, the United States, Germany, Brazil, and Spain.

Entities

Android · Bitdefender · Cubot · Doogee · Google Play · Google Play Store · MediaTek

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

Már a dobozból kivéve vírusos lehet a mobilod, több ezer androidos telefon érintett - ORIGO [www.origo.hu]
Alerta por “Midnight Mimosa”, un malware que venía de fábrica en celulares Android de gama baja [impactoinformativo.com.ar]
Low-cost Android dispositivi trovati con malware integrato [www.ilcorrierino.com]
El móvil super ventas de Xiaomi de gama media vuelve a tocar fondo: batería infinita y buenas fotos por menos de 300 euros [topesdegama.com]
Malware pre-installati sugli smartphone Android La ricerca di Bitdefender [www.ilcorrieredellasicurezza.it]
Midnight Mimosa: la razón para no comprar un Android barato [androidphoria.com]
Vous avez acheté un Android pas cher? Il est peut-être infecté par un malware impossible à supprimer [www.netcost-security.fr]
Midnight Mimosa: smartphone Android infetti già dalla fabbrica [www.batista70phone.com]
Bitdefender: Telefoane Android ieftine, infectate din fabrică [www.go4it.ro]
Midnight Mimosa : Des smartphones Android sont déjà infectés avant même leur première utilisation [alloforfait.fr]
Androidos telefonja van? Ezt mindenképp ellenőrizze, mielőtt túl késő lenne! [www.blikk.hu]
Android-Handys mit Schadsoftware ab Werk: Diese Billig-Modelle sind betroffen [www.futurezone.de]
Malware Found Preinstalled on Cheap, Counterfeit Android Phones [au.pcmag.com]
Midnight Mimosa: il malware nascosto negli smartphone Android low cost [www.libero.it]
In questi smartphone super economici c'è un malware preinstallato [www.smartworld.it]
Goedkope Androidtelefoons standaard geleverd met malware [www.security.nl]
Malware preinstallato su Android, allarme Bitdefender: migliaia di telefoni colpiti in 150 Paesi [www.tuttoandroid.net]
Allarme smartphone economici con malware nascosti: venduti anche in Italia [www.telefonino.net]
Midnight Mimosa Malware Found Preinstalled on Low-Cost Android Phones [hackread.com]
La France figure parmi les pays les plus touchés par ces smartphones Android vendus déjà infectés [www.phonandroid.com]