01.09.2026
3 min
215
Bitdefender researchers have uncovered a large-scale malware campaign called Midnight Mimosa, in which malicious software is installed on Android smartphones before they are even sold. The malware hides among system components, silently installs apps, and allows attackers to exploit infected devices for ad fraud and botnet operations.
Bitdefender researchers have identified thousands of low-cost Android devices infected with malware embedded directly into their firmware. Over two years of monitoring, the campaign was detected on thousands of unique devices across more than 150 countries. The highest numbers of cases were recorded in Mexico, France, Italy, the United States, and Germany.
The problem primarily affects budget smartphones powered by MediaTek processors and sold under various brand names. Some of these devices even have names resembling flagship models from well-known manufacturers, despite having no actual connection to those brands.
What makes this campaign particularly concerning is that users receive smartphones that are already infected. The malicious component is embedded in the system software and has elevated privileges, allowing it to operate without the owner’s knowledge.
According to Bitdefender’s research, Midnight Mimosa can independently install and uninstall apps, grant them necessary permissions, and execute code received from remote servers. This allows the campaign’s operators to modify the functionality of infected devices according to their needs.
The attackers primarily make money through advertising fraud. Additional applications are silently installed on smartphones, disguising themselves as legitimate tools such as weather apps, file managers, note-taking apps, app lockers, and image or text utilities. In reality, these apps can display advertisements in hidden windows and generate fraudulent views and clicks, earning money for their operators.
Some infected smartphones are also used as residential proxy servers. In such cases, third-party internet traffic is routed through the device owner’s connection, effectively turning the phone into part of a botnet. This allows attackers to conceal the true origins of network activity and exploit other people’s IP addresses for additional operations.
Researchers also identified 13 malicious apps distributed through Google Play that used infrastructure associated with Midnight Mimosa. Unlike the built-in system component, these applications did not have such extensive privileges, but they still posed a threat to users.
Midnight Mimosa uses another technique to conceal the installation of additional malware. Before installing a malicious application, the system component temporarily disables the Google Play Store and then reactivates it once the installation is complete.
In this way, attackers attempt to bypass Google Play Protect security checks, which can detect harmful applications. The entire process remains virtually invisible to the smartphone’s owner.
The main problem is that Midnight Mimosa is embedded in the system software. As a result, simply uninstalling applications or performing a factory reset does not guarantee that the device will be cleaned.
According to researchers, eliminating the infection requires cleaning the firmware or disabling the malicious component through Android Debug Bridge (ADB). However, both methods are complicated for most ordinary users.
“Cleaning the device requires removing the malicious component from the firmware or disabling it through ADB, neither of which is a realistic option for most owners of these phones,” the researchers explain.
Experts emphasize that a permanent solution largely depends on device manufacturers and online marketplaces that distribute smartphones with compromised firmware.
“A long-term solution depends on the manufacturers and marketplaces that supply and sell devices with compromised firmware,” Bitdefender researchers add.
Researchers have not yet determined who organized the Midnight Mimosa campaign or at what stage of production the malicious code is introduced into device firmware.
Some infected firmware images were signed using certificates associated with Shenzhen Zediel. The company may be connected to Chinese manufacturer Zedi Technology, which develops smart devices and motherboards based on Rockchip processors.
However, the presence of these certificates does not prove the company’s involvement in infecting smartphones. Researchers were unable to determine how the certificates ended up in the firmware or whether their owners knew they were being used in the malicious campaign.
“How these certificates ended up on these phones, and whether their owner was involved in or aware of the malware distribution, remains unclear,” the researchers note.
