Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [QUIET] · [TECHNOLOGY]
2 clusters · 8 sources · 3 days · First seen · Last updated
Midnight Mimosa Android malware campaign
Overview
Security researchers have identified a malware campaign named ‘Midnight Mimosa’ that is pre-installed in the firmware of thousands of low-cost Android devices. The infection affects more than 150 countries, with high rates noted in Mexico, France, Italy, the United States, Germany, Brazil, and Spain.
Specific models identified include the Doogee S200 X, Cubot KINGKONG X, and various counterfeit devices. Because the malicious code resides in the system partition or firmware, it remains on the device even after factory resets or app uninstallations. The campaign has reportedly been active for approximately two years.
The malware can automatically install roughly 32 different applications disguised as legitimate tools, such as weather apps or file managers. These applications are used to facilitate advertising fraud by generating fake clicks and views, or to utilize the device as a network traffic proxy. Experts note that remediation may require professional technical assistance or a clean firmware update from the manufacturer.
Entities
Doogee · Cubot · Bitdefender · Kaspersky · Apple
Timeline
-
[TECHNOLOGY] 3 sourcesCybersecurity experts warn of malware pre-installed on cheap Android phones
Cybersecurity experts warn that some inexpensive Android phones arrive with malware embedded in their firmware, allowing infections to survive factory resets and facilitate ad fraud or data theft.
-
[TECHNOLOGY] 5 sourcesMidnight Mimosa malware found in thousands of low-cost Android phones
The ‘Midnight Mimosa’ malware campaign has been found pre-installed in the firmware of thousands of low-cost Android phones across 150 countries, enabling ad fraud and network proxying.
Sources
baogialai.com.vn · biznismagazin.rs · bug.hr · cafef.vn · genk.vn · kenh14.vn · kurir.rs · soha.vn