A newly identified Android malware campaign dubbed Midnight Mimosa is targeting low-cost smartphones with malicious software embedded directly in device firmware, enabling attackers to install applications silently, conduct ad fraud, and potentially turn infected phones into residential proxies.
According to Bitdefender, the campaign affected thousands of Android devices across more than 150 countries over roughly two years. The highest concentrations of victims were observed in Mexico, France, Italy, the United States, Germany, Brazil, and Spain.
Malware Embedded Directly in Android Firmware
Unlike conventional Android malware, which typically requires a user to install a malicious app, Midnight Mimosa is embedded in the system partition before the device reaches the customer.
Researchers believe the compromise occurred somewhere in the hardware or firmware supply chain, although it remains unclear who modified the firmware or at what stage the tampering was introduced.
The malware has been observed on low-cost MediaTek-based devices using model names associated with legitimate manufacturers, including the Doogee S200 X and Cubot KINGKONG X, as well as counterfeit devices impersonating major smartphone brands.
Because the malicious components run with elevated system privileges, they can perform actions that ordinary Android applications cannot, including:
- Silently installing and removing applications.
- Granting sensitive permissions.
- Executing remotely downloaded code.
- Maintaining persistence after users attempt to remove malicious apps.
Some device owners reported that suspicious applications repeatedly reappeared after deletion. In one case, an official firmware update allegedly introduced the malware again after the device had been restored to a clean older firmware version.
SystemLite Acts as the Malware Control Platform
Bitdefender identified a suspicious system application named com.android.system.lite that served as a central control component.
The malware family also uses package names designed to resemble legitimate Android services, including:
com.android.system.litecom.android.sys.protcom.android.sys.gmsprot
Because these applications are installed as privileged system packages, they cannot normally be removed through Android’s standard uninstall interface.
The SystemLite component communicates with command-and-control (C2) servers, downloads additional modules, manages permissions, and deploys secondary applications used for monetization and remote control.
Midnight Mimosa Uses Cover Apps for Ad Fraud
Researchers identified approximately 32 applications associated with the malware framework, many disguised as legitimate utilities such as weather apps, app lockers, OCR tools, file managers, and audio editors.
Rather than generating fraudulent advertising activity directly from the core system component, Midnight Mimosa deploys secondary “cover apps” that load legitimate advertising SDKs.
These applications can:
- Display ads in invisible or hidden windows.
- Generate fraudulent advertising impressions.
- Interact with advertisements automatically.
- Display ads even when the user is not actively using the malicious application.
This approach allows attackers to monetize infected devices while making the activity appear more similar to legitimate mobile advertising traffic.
Malware Attempts to Bypass Google Play Protect
Midnight Mimosa also includes techniques designed to interfere with Android security controls.
Before installing additional payloads, the malware can temporarily disable the Google Play Store package (com.android.vending), which researchers believe is intended to prevent Google Play Protect from inspecting the installation process.
Once the malicious application has been deployed, the Play Store is re-enabled to reduce the likelihood that the user notices anything unusual.
Some variants also manipulate Android’s installer metadata, making sideloaded malicious applications appear as though they were installed through Google Play.
Infected Phones Can Become Residential Proxies
One of the most serious capabilities discovered in the campaign is the ability to convert infected smartphones into residential proxy nodes.
Bitdefender analyzed an app-locker application identified as com.mobile.applock.en that contained a TCP proxy component. Once activated, the component registers the infected device with remote infrastructure and can receive instructions to connect to specified hosts.
This functionality could allow attackers to route internet traffic through a victim’s mobile connection, hiding the true origin of malicious activity.
Residential proxies are particularly valuable to cybercriminals because traffic appears to originate from legitimate consumer IP addresses rather than known hosting providers or data centers.
Potential abuse scenarios include:
- Credential attacks.
- Fraudulent account activity.
- Web scraping.
- Access to geographically restricted services.
- Concealing the source of malicious traffic.
Bitdefender confirmed that the proxy infrastructure was active and accepting registrations, although researchers did not observe relay commands during their tests.
Related Apps Also Reached Google Play
The investigation also identified 13 Android applications distributed through Google Play that contained the same advertising-fraud components and communicated with Midnight Mimosa infrastructure.
These apps did not have the privileged access available to the firmware-level malware, meaning they could not silently install additional software. However, they were still capable of displaying advertisements outside their normal interfaces.
Researchers linked the applications to multiple signing certificates and at least two developer accounts.
Firmware-Level Infections Are Difficult to Remove
Midnight Mimosa presents a particularly serious remediation challenge because the primary malware components are installed as privileged system applications.
Simply performing a standard application uninstall may not remove the threat.
Affected users may need to:
- Install a verified clean firmware image.
- Apply a trusted manufacturer firmware update.
- Disable malicious system components through Android Debug Bridge (ADB).
- Perform additional forensic checks for secondary payloads and persistence mechanisms.
For organizations managing Android fleets, the campaign reinforces the importance of mobile supply-chain security, firmware verification, device attestation, application monitoring, and sourcing hardware from trusted vendors.
Midnight Mimosa shows how firmware-level compromise can turn an inexpensive smartphone into a persistent malware platform before the user even powers it on for the first time.
Leave a Reply