Key points
- Malware runs with system-level privileges on MediaTek-based Android devices.
- Operators use infected phones as residential proxies for botnets and ad fraud.
- Thirteen Google Play apps were found communicating with the same control servers.
Bitdefender discovered a firmware-level threat named Midnight Mimosa affecting low-cost Android smartphones. The cybersecurity firm stated that the malicious software is baked directly into the device firmware before shipping. This allows operators to control the devices remotely without user interaction or visible signs of compromise on the interface.
The malware package, identified as "com.android.system.lite," operates with system-level privileges. According to Bitdefender, this elevated access permits the software to install or uninstall applications at will. It can also grant itself permissions for accessibility services, notifications, and SMS access. The malware loads arbitrary code supplied remotely by the operators to expand its capabilities on the infected device.
How the Malware Operates
The malware fetches configuration data from an external server to download and execute additional payloads. Bitdefender explained that these payloads are designed to conduct ad fraud and silently install or remove partner applications. The operators can grant permission to any Android app package, effectively bypassing standard security checks. This allows the malware to tune each device to specific operational needs determined by the threat actors.
A key tactic involves disabling the Google Play Store app before installing a payload. Bitdefender noted this is likely an attempt to bypass Play Protect safeguards. After the payload runs, the malware re-enables the Play Store. This behavior helps the operators maintain control while avoiding immediate detection by Google’s automated security scanning systems.
Who Is Affected
The campaign targets Android devices built on MediaTek platforms across several brands. Bitdefender detected the malware on devices with firmware signed using certificates attributed to Shenzhen Zediel Co., Ltd. This Chinese manufacturer produces Android devices for various brands. The discovery indicates that the compromise occurs at the manufacturing or firmware level rather than through user-side downloads.
Bitdefender also found thirteen apps on Google Play that communicate with the same servers controlling the firmware malware. This finding suggests the campaign extends beyond preinstalled firmware. The dropper apps masquerade as harmless utilities but load genuine ads through legitimate SDKs to generate revenue for the operators.
Next steps
The primary goal of this scheme is revenue generation through ad fraud and botnet activity. Operators turn infected devices into residential-proxy relay nodes, making them zombies in large networks. The malware itself does not perform fraudulent clicks. Instead, it loads an invisible window on top of apps to register ad impressions. This sophisticated approach makes the activity difficult for users to detect through normal usage patterns.
Background: Firmware malware
Firmware is the low-level software that controls hardware, while malware is malicious code. The critical difference is that firmware malware infects the hardware’s permanent storage. This allows the threat to persist even after you wipe the hard drive, making it significantly harder to remove than standard file-based infections.
Read the full guide: What Is the Difference Between Firmware and Malware
What to do and how to stay safe: Bitdefender
- Review installed applications for unknown utilities that request excessive permissions such as accessibility or SMS access.
- Monitor network traffic for unexpected connections to unknown external servers that may indicate proxy activity.
- Keep device firmware updated to the latest version provided by the manufacturer to patch known vulnerabilities.
- Check for signs of the Google Play Store being disabled unexpectedly, which may indicate active malware intervention.
Step-by-step guide: Phishing Defined: Anatomy of the Attack and Risk Reduction
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can I remove Midnight Mimosa from my phone?
Because the malware is baked into the firmware, standard app removal methods may not work. You may need a factory reset or firmware reflash.
Which brands are affected by this malware?
Bitdefender stated the malware affects low-cost Android devices built on MediaTek platforms across several brands, including those from Shenzhen Zediel Co., Ltd.
Is this malware actively stealing passwords?
The source material focuses on ad fraud, proxy usage, and silent app installation. It does not mention direct password theft as a primary function.
