Full Report
Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa. The preinstalled
Analysis Summary
# Tool/Technique: Midnight Mimosa
## Overview
Midnight Mimosa is a malicious campaign involving preinstalled firmware-level malware on low-cost Android smartphones, primarily those built on MediaTek platforms. The primary purpose of this malware is to establish a persistent, system-level backdoor that enables ad fraud, the installation of unauthorized applications, and the conversion of devices into residential proxy relay nodes for botnet operations.
## Technical Details
- **Type:** Malware Family (Firmware Backdoor / Dropper)
- **Platform:** Android (specifically MediaTek-based devices)
- **Capabilities:** System-level privilege execution, remote code execution, app management (install/uninstall), permission manipulation, and proxyware hosting.
- **First Seen:** Reported October 2026 (Investigation likely began earlier)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1474 - Supply Chain Compromise]
- **[TA0003 - Persistence]**
- [T1542.001 - Pre-OS Boot: System Firmware]
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools] (Disabling Google Play Store)
- [T1622 - Debugger Evasion] (Implied via Play Protect bypass)
- **[TA0002 - Execution]**
- [T1059.009 - Command and Scripting Interpreter: Android Terminal]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **System-Level Persistence:** Operates as `com.android.system.lite` within the system partition, making standard uninstallation impossible.
- **App Management:** Covertly installs or uninstalls partner applications and payloads without user interaction.
- **Permission Escalation:** Automatically grants itself and secondary payloads access to Accessibility Services, SMS, and Notifications.
- **Payload Delivery:** Fetches remote configurations to download additional modules for specific fraudulent activities.
### Advanced Features
- **Residential Proxy Integration:** Turns the infected device into a "zombie" node, routing traffic for third parties to mask their origins.
- **Security Software Suppression:** Temporarily disables the Google Play Store and Play Protect during the installation of malicious payloads to avoid detection.
- **Supply Chain Integration:** The malware is signed with manufacturer certificates (e.g., Shenzhen Zediel Co., Ltd), allowing it to blend into legitimate system processes.
## Indicators of Compromise
### File Names / Package Names
- `com.android.system.lite` (Core Malware)
- `com.audify.editor.wavrge`
- `appicon.diy.tools.prop`
- `com.audify.editor.pro`
- `com.prorestore.qr`
- `com.message.recovery.prorestore`
- `com.go.weather.mot`
- `com.cool.weather.yl`
- `com.dmstudio.weather`
- `com.dl.guard.lock`
- `picturetranslate.extractor.text.lite`
- `com.notemaster.record.mark`
- `com.arabmusic.tap.aghani_tamerhosny`
- `org.life.goal.tools`
### Network Indicators
- C2 communication for remote configuration (Domains/IPs managed by operators - *Specific C2 URLs not provided in text*).
### Behavioral Indicators
- Sudden disabling/re-enabling of the Google Play Store app.
- Requests for Accessibility Services from utility or weather apps.
- High background data usage related to proxy relaying.
## Associated Threat Actors
- **Midnight Mimosa Operators:** (Potentially linked to infrastructure previously used by **Android.Phantom**).
## Detection Methods
- **Signature-based detection:** Scanning for the `com.android.system.lite` package in the system partition.
- **Behavioral detection:** Monitoring for unauthorized calls to the `pm install` or `pm uninstall` commands by non-store applications.
- **Supply Chain Audit:** Verifying the integrity of firmware signatures against known clean baselines from manufacturers.
## Mitigation Strategies
- **Prevention:** Purchase Android devices from reputable manufacturers with transparent supply chains.
- **Hardening:** For technical users, use Android Debug Bridge (ADB) to manually disable the malicious package if it cannot be uninstalled.
- **Firmware Updates:** Apply official firmware patches from the vendor (if available) to overwrite compromised partitions.
## Related Tools/Techniques
- **Android.Phantom:** Shared infrastructure and similar ad-fraud goals.
- **Keenadu:** A similar firmware-level backdoor discovered in tablets for ad fraud.
- **Residential Proxyware:** Similar to "SDK-based" proxy tools that monetize user bandwidth.