Firmware-Level Malware Targets Budget Android Devices Globally
Bitdefender has identified a widespread malware campaign dubbed Midnight Mimosa that infects low-cost Android devices through malicious firmware preinstalled at the factory level. The malware operates as a persistent system app with elevated privileges, making it impossible to remove via standard user uninstall procedures. Once activated, it establishes communication with attacker-controlled command-and-control (C2) servers, granting threat actors full remote access to the device.
The malware’s capabilities include silently installing and removing applications, granting or revoking permissions, and executing arbitrary code delivered remotely. This level of control allows operators to repurpose infected devices for various malicious purposes, including ad fraud, click fraud, and integration into large-scale botnets.
Global Reach and Distribution Patterns
Over the past two years, Bitdefender has observed thousands of unique infected devices spanning more than 150 countries. No single region dominates the infection rate, though Mexico and France report the highest numbers, followed by Italy, the United States, Germany, Brazil, and Spain. Western Europe and the Americas collectively show the strongest concentration of affected devices.
The campaign primarily targets devices built on MediaTek platforms, which are commonly used in budget smartphones sold globally. Attackers exploit the supply chain by injecting malware into the device firmware before distribution, ensuring infection occurs the moment the user powers on the device.
Beyond Firmware: Malware Found in Google Play Store Apps
Bitdefender’s investigation revealed that the Midnight Mimosa threat extends beyond preinstalled firmware. Researchers identified 13 applications available on Google Play, distributed under two developer accounts, that contain the same malicious code signatures as the firmware-based variant. While these Play Store apps do not inherit system-level privileges, they serve as a secondary distribution channel for the malware.
Notably, the malware employs evasion techniques to bypass Google Play Protect. During the installation of additional payloads, it temporarily disables the Play Store and blinds Google’s security scanning mechanisms, creating a window where malicious installations occur undetected. Afterward, the Play Store is re-enabled to avoid raising suspicion.
Botnet Recruitment and Financial Motivation
The primary objectives of the Midnight Mimosa campaign appear to be ad fraud and automated click fraud, which generate revenue through fraudulent ad impressions and clicks. By scaling infections across thousands of devices, attackers can build lucrative botnets that are either used directly for fraud or rented out to other cybercriminals.
Bitdefender’s report emphasizes that the larger the botnet, the greater the potential return on investment for the operators. Although the exact financial gains have not been disclosed, the scale of deployment — spanning over 150 countries — suggests a significant monetization effort.
Indicators of Compromise and Defensive Guidance
While the report does not attribute the campaign to a specific threat actor group, it provides a comprehensive list of indicators of compromise (IoCs) to assist organizations and security teams in detecting and blocking Midnight Mimosa-related activity. These IoCs include file hashes, domain names, and behavioral patterns associated with the malware’s communication and execution routines.
Bitdefender classifies Midnight Mimosa as a supply-chain threat due to its reliance on pre-installed firmware manipulation. This method ensures persistence and stealth, allowing attackers to maintain control over devices from the moment of first use without requiring user interaction or social engineering.
Source: SecurityWeek