Midnight Mimosa Malware Found Preinstalled on Low-Cost Android Phones
Summary
Bitdefender found Midnight Mimosa malware embedded in low-cost Android phone firmware, enabling silent app installation, ad fraud, and residential proxy activity. The campaign affected thousands of devices in more than 150 countries.
Key points
- The malware was embedded in firmware on low-cost MediaTek-based Android phones, giving it system-level privileges to install apps and grant permissions without user interaction.
- Bitdefender estimates thousands of devices across more than 150 countries were affected over roughly two years.
- The malware installs cover apps that generate fraudulent ad impressions and clicks, including through hidden windows and automatic ad interaction.
- It can temporarily disable Google Play Store to hinder Play Protect detection and alter installer records to make apps appear to come from Google Play.
- A proxy component can register infected phones with a command server and relay traffic; researchers confirmed the infrastructure accepted registrations but did not verify active relaying.
- Bitdefender also found 13 Google Play apps containing related ad-fraud code, but these lacked the elevated privileges of the firmware-installed components.
- Removal may require firmware-level cleanup or disabling the component with Android Debug Bridge; some manufacturers reportedly released updates that resolved infections.
Article Details
- Attack Vectors
- Malware is embedded in the system partition of low-cost Android phones using MediaTek chipsets before customers receive them. Supply-chain introduction is suspected, but the responsible party and tampering stage are unknown.
- Signed malicious system applications use elevated privileges to silently install and remove applications, grant sensitive permissions, and execute remotely downloaded code.
- Downloaded applications disguise themselves as ordinary utilities and generate fraudulent advertising impressions and clicks through hidden windows and automated interactions.
- A malicious app-locker application registers infected phones with a remote command server and supports connecting to specified hosts and forwarding traffic.
- Bitdefender identified 13 Google Play Store applications containing the same advertising-fraud code and communicating with known malicious infrastructure. These applications lack the elevated privileges required for silent software installation.
- One Doogee Fire 3 Max owner reported that an official firmware update introduced the infection, that restoring older firmware removed it, and that reinstalling the update restored it.
- Defensive Notes
- The malicious system applications cannot be removed through Android's normal application uninstall process.
- Bitdefender says remediation requires firmware-level cleanup or disabling the malicious component using Android Debug Bridge (ADB).
- Some users reported that manufacturer firmware updates resolved infections, but manufacturers have not publicly explained how the malicious software entered the affected firmware.
- The malware temporarily disables the Google Play Store before installing applications and re-enables it afterward; Bitdefender attributes this behavior to evasion of Google Play Protect.
- Some variants falsify recorded installer information to make directly installed malicious applications appear to originate from Google Play.
- Bitdefender confirmed that the proxy command infrastructure accepted device registrations, but its test device received no relay targets, leaving active traffic forwarding unconfirmed.
MITRE ATT&CK
T1090 · ProxyThe malicious com.mobile.applock.en application contains a TCP proxy component that registers infected phones with a command server and can forward traffic to specified hosts; active relaying was not confirmed during testing.T1105 · Ingress Tool TransferThe privileged system application downloads additional malicious modules from command-and-control servers.T1444Preinstalled malicious applications impersonate Android system packages, while downloaded applications disguise themselves as weather utilities, file managers, app lockers, OCR tools, and audio editors.T1629.003The malware temporarily disables the Google Play Store before silent application installation, which Bitdefender says is intended to prevent Google Play Protect detection.
Vendors
BitdefenderAccording to Bitdefender researchers, the campaign affected thousands of devices across more than 150 countries over approximately two years, with the highest number of victims in Mexico, France, Italy, United States,Cuboton devices with model names associated with legitimate manufacturers, including the Doogee S200 X and Cubot KINGKONG X, as well as phones impersonating Samsung and Apple products.Doogeepreinstalled malware on devices with model names associated with legitimate manufacturers, including the Doogee S200 X and Cubot KINGKONG X, as well as phones impersonating Samsung and Apple products.MediaTekThe malware is embedded directly into the firmware of low-cost Android devices using MediaTek chipsets, giving it system-level privileges that allow it to install and remove applications, grant sensitive permissions,Shenzhen ZedielThe researchers also found firmware signed using certificates associated with Chinese device manufacturer Shenzhen Zediel, but said it is unclear whether the company was involved in the malware's campaign.
Products
AndroidLow-cost Android phones ship with residential proxy malwareApp Anomaly DetectionBitdefender discovered the campaign after its App Anomaly Detection technology flagged a suspicious system application named com.android.system.lite that was silently installing and removing other applications.Cubot KINGKONG Xdevices with model names associated with legitimate manufacturers, including the Doogee S200 X and Cubot KINGKONG X, as well as phones impersonating Samsung and Apple products.Doogee Fire 3 MaxOne Doogee Fire 3 Max owner also reported that an official firmware update infected the device with the malware, which disappeared after restoring an older firmware version but returned when the update was installedDoogee S200 Xmalware on devices with model names associated with legitimate manufacturers, including the Doogee S200 X and Cubot KINGKONG X, as well as phones impersonating Samsung and Apple products.Google Play Protectthe Google Play Store app, com.android.vending, which Bitdefender says is intended to prevent Google Play Protect from detecting the installation.Google Play StoreBefore silently installing malicious applications, it temporarily disables the Google Play Store app, com.android.vending, which Bitdefender says is intended to prevent Google Play Protect from detecting the
Tools
Countries
Braziltwo years, with the highest number of victims in Mexico, France, Italy, United States, Germany, Brazil, and Spain.Francemore than 150 countries over approximately two years, with the highest number of victims in Mexico, France, Italy, United States, Germany, Brazil, and Spain.Germanyapproximately two years, with the highest number of victims in Mexico, France, Italy, United States, Germany, Brazil, and Spain.Italythan 150 countries over approximately two years, with the highest number of victims in Mexico, France, Italy, United States, Germany, Brazil, and Spain.Mexicoacross more than 150 countries over approximately two years, with the highest number of victims in Mexico, France, Italy, United States, Germany, Brazil, and Spain.Spainyears, with the highest number of victims in Mexico, France, Italy, United States, Germany, Brazil, and Spain.United Statescountries over approximately two years, with the highest number of victims in Mexico, France, Italy, United States, Germany, Brazil, and Spain.