Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [QUIET] · [TECHNOLOGY]
2 clusters · 32 sources · 3 days · First seen · Last updated
Midnight Mimosa Android firmware malware
Overview
Cybersecurity researchers at Bitdefender have identified a widespread malware campaign named ‘Midnight Mimosa’ that is preinstalled in the firmware of low-cost Android devices. The infection occurs at the manufacturing or supply chain level, targeting budget smartphones and counterfeits using MediaTek chipsets, including brands such as Doogee and Cubot.
Because the malicious code resides within the system partition, standard security measures like Google Play Protect can be bypassed, and factory resets may fail to remove the infection. The malware operates with high-level system privileges, allowing it to silently install or remove applications, grant permissions to SMS and accessibility services, and execute remote code. To evade detection, it uses names that mimic legitimate Android components, such as ‘com.android.system.lite’.
The campaign’s primary objectives include financial monetization through advertising fraud—using invisible overlays on legitimate apps to generate fraudulent ad clicks—and turning infected devices into residential proxies to mask cybercriminal activity. These devices can be utilized as part of massive botnets for DDoS attacks. The malware has reportedly affected thousands of devices across more than 150 countries.
Recent reports indicate a high concentration of affected devices in Mexico, France, Italy, the United States, Germany, Brazil, and Spain. Experts advise users who suspect an infection to avoid using the device for sensitive accounts and to seek replacements from established manufacturers.
Entities
Android · Doogee · Google Play Store · Cubot · Bitdefender
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 11 SOURCES] Security researchers identified a malware campaign named Midnight Mimosa.
- [● 11 SOURCES] Malware is used for ad fraud, building botnets, and acting as residential proxies.
- [● 10 SOURCES] The campaign has affected thousands of devices across more than 150 countries.
- [● 8 SOURCES] The malware operates with system-level privileges, allowing it to install or remove apps and grant itself permissions.
- [● 8 SOURCES] The malware specifically targets budget Android smartphones utilizing MediaTek chipsets.
- [● 6 SOURCES] The malware disguises itself using names like com.android.system.lite.
- [● 5 SOURCES] A standard factory reset is insufficient to remove the infection.
- [● 4 SOURCES] Affected devices were frequently detected in Mexico, France, Italy, the USA, Germany, Brazil, and Spain.
- [● 2 SOURCES] Thirteen applications on Google Play were found to use the same ad fraud code and connect to the same control servers as the malware.
Timeline
-
[TECHNOLOGY] 12 sourcesMidnight Mimosa malware preinstalled in budget Android smartphone firmware
Bitdefender has identified Midnight Mimosa, a malware campaign preinstalled in the firmware of budget Android phones, enabling ad fraud and the creation of botnets across more than 150 countries.
-
[TECHNOLOGY] 20 sourcesMidnight Mimosa malware found preinstalled on low-cost Android phones
Bitdefender has discovered Midnight Mimosa, a malware preinstalled in the firmware of low-cost Android phones, enabling ad fraud and proxyware activity across 150 countries.
Sources
alloforfait.fr · androidphoria.com · au.pcmag.com · batista70phone.com · blikk.hu · chip.cz · cybernoz.com · cybersecuritynews.es · dobreprogramy.pl · focus.de · futurezone.de · go4it.ro · hackread.com · ilcorrieredellasicurezza.it · ilcorrierino.com · impactoinformativo.com.ar · it-daily.net · me.pcmag.com · netcost-security.fr · pcauthority.com.au · phonandroid.com · security.nl · sibiu100.ro · smartworld.it · stiripesurse.ro · tecnogus.com.co · tecnologia.libero.it · telefonino.net · thehackernews.com · topesdegama.com · toysforlife.co.nz · tuttoandroid.net
This summary has been updated 2 times: see revision history