Key points
- Malware named Midnight Mimosa runs with system-level privileges on MediaTek Android devices.
- The code disables Google Play Store temporarily to bypass security checks during payload installation.
- Bitdefender identified 13 Google Play apps communicating with the same command-and-control servers.
Bitdefender has identified a campaign where low-cost Android smartphones ship with malicious software embedded directly into the device firmware. The security firm tracks this activity under the name Midnight Mimosa, noting that it affects devices built on MediaTek platforms across several brands.
The malware, identified as com.android.system.lite, operates with system-level privileges. This high level of access allows the code to install or uninstall applications silently, grant itself permissions for accessibility services, notifications, and SMS, and execute arbitrary code supplied remotely by operators. According to The Hacker News, the software fetches configurations from external servers to download additional payloads designed for ad fraud and proxy operations.
How the malware operates
The primary goal of this scheme appears to be revenue generation through ad and click fraud, as well as turning infected devices into residential proxy nodes. Bitdefender explains that the malware itself does not perform fraudulent clicks. Instead, it installs dropper apps that masquerade as harmless utilities. These apps use legitimate advertising SDKs to load genuine ads, displaying them in invisible windows to generate fraudulent impressions.
A significant technical detail is how the malware bypasses security controls. It disables the Google Play Store application before installing a payload, likely to evade Play Protect safeguards, and then re-enables the store after the payload runs. This behaviour allows operators to tune each device to their needs, effectively creating large botnets of compromised residential proxies.
Who is affected
The campaign targets Android devices manufactured by Shenzhen Zediel Co., Ltd, a Chinese company. Bitdefender detected the malware on devices with firmware signed using certificates attributed to this manufacturer. The presence of system-level malware means that standard user actions cannot easily remove the threat, as it is baked into the core firmware of the phone.
Furthermore, the campaign is not limited to factory-installed firmware. Bitdefender discovered 13 applications on Google Play that communicate with the same servers controlling the Midnight Mimosa malware. This suggests that users may also be at risk from downloading these companion apps, which facilitate the remote management of the infected devices and the execution of further malicious code.
Our take on the response
The integration of malware into the firmware layer represents a significant supply chain compromise. Because the malicious code runs with system privileges, it can grant permissions to any Android app package, effectively undermining the security model of the operating system. Security teams should monitor for unusual network traffic patterns indicative of proxy activity or ad fraud on managed devices.
That suggests that standard endpoint detection may struggle to identify the threat if it relies solely on behavioural analysis of user-space applications. The fact that the malware disables the Play Store indicates a sophisticated understanding of Android security mechanisms, requiring deeper forensic analysis of system-level processes and certificate validation.
What to do and how to stay safe: Bitdefender
- Audit devices for unknown system-level processes, particularly those with names resembling standard Android components but with unusual package identifiers.
- Monitor network logs for connections to known command-and-control servers associated with the Midnight Mimosa campaign or unexpected outbound traffic on non-standard ports.
- Check installed applications for unknown utilities that request excessive permissions, such as accessibility services or SMS access, especially on low-cost hardware.
- Verify the integrity of device firmware by comparing hash values against known good baselines provided by the original equipment manufacturer, where possible.
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the name of the malware found in the firmware?
Bitdefender tracks the malware under the moniker Midnight Mimosa, with the specific package name com.android.system.lite.
Which manufacturer is linked to the affected devices?
The malware has been detected on devices with firmware signed using certificates attributed to Shenzhen Zediel Co., Ltd.
Does the malware perform fraudulent clicks directly?
No, the malware installs dropper apps that load genuine ads in invisible windows to generate fraudulent impressions and revenue.