[CLSTR]
< Back to situation

[REVISION HISTORY]

Midnight Mimosa Android firmware malware

Updated 2 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-12 09:34 UTC → 2026-10-13 15:10 UTC · added removed

Cybersecurity researchers at Bitdefender have identified a widespread malware campaign named ‘Midnight Mimosa’ that is preinstalled in the firmware of low-cost Android devices. The infection occurs at the manufacturing or supply chain level, targeting budget smartphones and counterfeits using MediaTek chipsets, including brands such as Doogee and Cubot. Because the malicious code resides within the system partition, standard security measures like Google Play Protect can be bypassed, and factory resets may fail to remove the infection. The malware operates with high-level system privileges, allowing it to silently install or remove applications, grant permissions, permissions to SMS and accessibility services, and execute remote code. To evade detection, it uses names that mimic legitimate Android components, such as ‘com.android.system.lite’. The campaign’s primary objectives include financial monetization through advertising fraud—using fake applications invisible overlays on legitimate apps to generate fraudulent ad clicks—and turning infected devices into residential proxies to mask cybercriminal activity. These devices can be utilized as part of massive botnets for DDoS attacks. The malware has reportedly affected thousands of devices across more than 150 countries. Recent reports indicate a high concentration of affected devices in Mexico, France, Italy, the United States, Germany, Brazil, and Spain. Beyond advertising fraud and proxy usage, the malware has also been linked to conducting DDoS attacks and collecting device information. Experts advise users who suspect an infection to avoid using the device for sensitive accounts and to seek replacements from established manufacturers.

Versions

  1. 2026-10-13 15:10 UTC Midnight Mimosa Android firmware malware
  2. 2026-10-12 09:34 UTC Midnight Mimosa Android firmware malware
  3. 2026-10-12 06:04 UTC Midnight Mimosa Android firmware malware

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.