Midnight Mimosa is reaching Android phones before their owners even press the power button. The malware arrives inside device firmware, giving its operators a hidden foothold that does not depend on a malicious download, a phishing link, or someone accepting an app permission request.

The campaign affects low-cost Android devices from several brands built on MediaTek platforms. Its main purpose appears to be making money through fake advertising activity and residential proxy services, while its system access also allows operators to install apps, remove them, and load new code without asking users.

Researchers from Bitdefender identified Midnight Mimosa after their App Anomaly Detection technology flagged a system package behaving unlike a normal Android component.

The detailed malware research report by Bitdefender, published October 8 and updated October 9, describes thousands of affected devices across more than 150 countries during a roughly two-year observation window.

Mexico, France, and Italy led the observed distribution, followed by the United States, Germany, Brazil, and Spain. These findings reflect Bitdefender’s visibility, not a complete global infection count.

Some phones also reported counterfeit flagship names, meaning their model labels cannot reliably identify the hardware or its actual manufacturer.

Midnight Mimosa Infects Android Phones

The investigation started with a hidden component labelled “System.” Signed with a platform certificate and running under Android’s system user, it could install packages and grant permissions silently.

com.android.system.lite (Source - Bitdefender) — com.android.system.lite (Source – Bitdefender)

Unlike an ordinary downloaded app, this firmware component could not be removed through the phone’s normal uninstall controls. This delivery method puts the problem inside the device supply chain rather than placing responsibility on the owner.

Earlier cases involving preinstalled Android firmware malware show why reviewing downloaded apps alone cannot protect a phone that already contains a trusted but harmful system component when it leaves the seller.

The malware hides much of its code in a native library. During startup, that library decrypts an embedded APK using RC4 and loads a hidden Java framework.

The framework then downloads further DEX and JAR modules, allowing the operators to change the phone’s behavior after purchase. Those modules handle fake ad clicks, app installation, and additional downloads.

Some JAR files are stored with an object-file extension, while downloadable modules are served as PNG files. These layers make the original APK a poor guide to what the malware will eventually do on a working device.

Hidden Ads and Proxy Traffic

Bitdefender found at least 32 disguised apps in the wider operation, including weather tools, app locks, file managers, and text scanners.

The system component repeatedly installs and removes these payloads. That rotation changes the visible app inventory while leaving the main firmware infection in place.

Advertising revenue comes through ordinary-looking cover apps carrying a legitimate advertising SDK. Hidden activity creates impressions and clicks without real user input, with timing limits intended to make traffic look natural.

The related Android Phantom click fraud research offers useful background on similar tools and infrastructure identified in this investigation.

Cunterfeit Android phones (Source - Bitdefender) — Cunterfeit Android phones (Source – Bitdefender)

A separate fake app-lock payload can enroll the phone as a residential proxy, letting a remote operator route traffic through its connection.

Earlier research into BADBOX Android proxy malware illustrates the wider risk of consumer devices becoming network relays. However, Bitdefender did not observe traffic being relayed during its fresh-node test.

Before installing payloads, the malware disables the Google Play Store package, apparently to avoid detection by Play Protect, and then enables it again.

It also restores the store when the user is present. Some samples falsely record Google Play as their installer, despite lacking Google’s distribution signature block.

Researchers also found the same ad-fraud code in 13 Google Play apps. Those store builds lacked the system powers of the preinstalled malware but still displayed ads outside their normal interface.

Previous reporting on Google Play advertising fraud shows why official distribution alone does not guarantee harmless behavior. The system component requests sensitive access involving Accessibility, notifications, and SMS.

Researchers observed repeated enabling and disabling of Accessibility and Notification Access, but did not see those capabilities used for theft. Their presence, combined with remote code loading, leaves room for operators to expand the campaign beyond advertising fraud.

Some affected firmware used certificates bearing Shenzhen Zediel’s name, but Bitdefender did not establish that the company created, approved, or knowingly distributed the malware.

The point where it entered the supply chain remains unknown. Durable cleanup requires firmware-level work; normal uninstall methods cannot remove the root component.

Vendors and sellers therefore hold a central role in fixing affected devices. Crucially, the report corrects one network finding: an address first described as a proxy command server was actually a sinkhole, not confirmed attacker infrastructure.

Indicators of compromise (IoCs)

Network, File, and Detection Indicators

Type	Indicator	Context
Control endpoint	`api.weatherlive[.]world/br_upgrade/upgradeV2/getConfigs`	Encrypted module configuration and control channel.
Telemetry endpoint	`api.weatherlive[.]world/odborwer_dot/cm`	Device telemetry and fabricated advertising events.
Download host	`oss.showtimetool[.]com`	Module and asset delivery; payloads served with `.png` extensions.
Reporting endpoint	`39.96.8.180:9008/ssc/rprt/bug`	DX/S1 framework bug-report endpoint.
Reporting endpoint	`120.78.215.151:80/api/bugLog`	Embedded-framework crash-report endpoint.
Proxy host pattern	`{productId}.apple.`	Proxyware control-host construction.
Proxy domain	`0aa0cf0637d66c0d[.]com`	Domain in the proxyware host rotation.
Proxy domain	`aa86a52a98162b7d[.]com`	Domain in the proxyware host rotation.
Proxy domain	`442fe7151fb1e9b5[.]com`	Domain in the proxyware host rotation.
Proxy domain	`v46wd6uramzkmeeo[.]in`	Domain in the proxyware host rotation.
Related infrastructure	`cgb.jingongbuxiao[.]com`	Shared indicator cited in the Android.Phantom operator-lineage analysis.
Related endpoint	`5.ahd187[.]com/thirdsdk/flowcashpack/`	Shared Android.Phantom-related download infrastructure.
Historical related domain	`zhuifengzhe[.]top`	Infrastructure connecting earlier Joker and Phantom research.
Related host	`fyapi.freeflightbird[.]com`	Host listed in the Phantom/Click lineage.
Related host	`newsadapi.zhuifengzhe[.]top`	Host listed in the Phantom/Click lineage.
Native library	`libeasy.so`	Native core that decrypts and drops the hidden framework.
Native-library MD5	`a8847b68428fde206b6dff8001051f92`	MD5 published for `libeasy.so`.
Renamed native library	`libunionprt.so`	Native core name used by a confirmed variant.
Framework namespace	`cn.kw.lib.hex`	Hidden framework dropped by the native core.
Loader/files	`cn.kw.lib.dx.DxFactory`; `kwlib.jar`; `kwlib.next`	Remote framework loading and update artifacts.
Plugin files	`files/plg/`; `magic.o.info`	JAR plugin and its descriptor; angle-bracket value is variable.
Bundled payload	`assets/mediaapp-release.apk`	Partner APK embedded inside stage-three plugins.
Plugin classes	`com.wz.sdk.DxFactory`; `com.earnsdk.lib.DxFactory`; `com.gogo.third.lib.DxFactory`	Ad-fraud and silent-install modules.
Payload markers	`EnLoaderLib` v1.0.6; `com.ctr.cbd`	Proxyware loader and separate ad-fraud module.
Service marker	`com.media.am.intent.action.BIND_SERVICE`; `MyDataService`	Communication between cover apps in the advertising mesh.
Install-source marker	Installer recorded as `com.android.vending`, without Play “frosting”	Forged Google Play provenance in identified samples.
Device-context marker	Wi-Fi MAC prefix `A0:53:94`	Zediel-associated allocation; not proof of infection by itself.
Partial certificate marker	`0105bc4c…`	Published platform-certificate prefix, not a complete hash or proof of company involvement.
String cipher	`AES-128-CFB`; key derived with `MD5("aGV4QCFRQFcjRQ==")`; IV `0102030405060708`	Hidden-framework string encryption.
String cipher	`AES-128-CFB`; key derived with `MD5("dHhAZXhAc2Vy")`	Enabler string encryption.
String cipher	`AES/CFB`; key derived with `MD5("ZHhAIVFAVyNF")`	Stage-three plugin string encryption.

Corrected Infrastructure Finding

Indicator	Corrected status	Handling note
`85.17.70.38:6000`	Sinkhole	Bitdefender initially described this address as live proxyware C2, then corrected that finding. Do not label it confirmed attacker-controlled infrastructure.

Complete Published Sample Set: 120 MD5 Hashes

Android package	Published MD5 hashes
`com.android.browser`	`05ae89e761a890fa24f80f4be7263651` `1da42505f1c83959c7f901f5139a158e` `a147cd8f72aadfcf78f7723db6813e86` `f456f0c6b89bd3d5124699d43971d094`
`com.android.deskclock`	`2c77653b889dfccd649b82446f8c0d1b` `5d29e9b24708c3ec36d1d59036124838` `998e9010e5dfc4e4645f5572cbbe5b53` `b3a4405d1b8d43545d07b10581008d32`
`com.android.gallery3d`	`0377ca97ac0ca35f9134052fede67a81` `0b0d8e995e6ff24d4e9d00417446c25e` `1414d4ef2d1191080abc59a407dcb6c5` `345057421c7d9ac2b671c47449f35030` `36deebfcda4012d18706cd170c1edf1f` `37f18a20b9cf32e6f07450e903eaad7c` `4507363415e7dc6d2cab14eeed137f6c` `512a6db4a22244272826f39da020fb44` `5b3a49938f455d1197736971c4c07228` `6aca76699ec0bb8e51372d5c68c8359b` `815b910f1efc95f38ba0c5b12c4f2129` `c75ec7f3bcbc879aae9a21ad544d3232` `d9fc6b2cd5eaa3929207f1029663d947` `e51c11442a529dcd06dc7c8e45974ec2` `e9b91e1d94bb3ff9a1c00b1c13eb7960`
`com.android.settings`	`be22c91b4578ac2357a16133615df335`
`com.android.sys.bcprot`	`d5d88214170875386ab855172f881e51` `dce5b0dc0e7d7059b5ab8384a7c24ec4`
`com.android.sys.dts`	`61aac6a98abd6dcff0dc41bb88159786`
`com.android.sys.gmsprot`	`2b784622422f4280e0b3e38b30dd87bc`
`com.android.sys.prot`	`2b7f1a7d5f5515c05d0c8e3857155ae2` `3d3358b1057b1bfbd7e60577d8a31e0c` `7400c34f7c6f866499029f5e759f58bd` `d4ceb05682ecd60f4ebb4e76e02fcf7d`
`com.android.system.lite`	`60bc23d3d453f258e2c4ca421cd086a9` `b862681953e945439167a736ba4cd41b`
`com.android.weapps`	`ed1a6bed83899952b464c27aef9752cc`
`com.android.weiapps`	`0903d7fd3e1d4a599a7eb3c5d356779b`
`com.mb.applock.a02`	`a57a1ba15364dfb35d334f644d7049e8`
`com.mb.applock.ea`	`cde0490e11db8ad54737c1df59ec658b`
`com.mobile.applock.en`	`08d231c6a5303e543eb60d4181f6a4ea` `7f7747575980098bdc98e7b7aa362697` `d3faec4f013c4a1e84a1d681448312c0`
`com.mobile.applock.tg`	`e75e183027bf897eda6447366c7acd01`
`com.mobile.applock.wg`	`20108557cacd24263e7e611afc327801` `aac942aaf6ec0773cbac87fde4a6b284` `cf20de9d9ddc952bb2265002d26a916f` `f602230f54507cbddf5ef3014737d768`
`com.mobile.applock.wt`	`079298a7a506b376def4f4ff9a250672` `20cefb2c667f945d482daded7e698eea` `254bc5f6f81de1f3c47534e6febaf023` `31b3280f1c0836c39c470932cf6c3e6f` `3b35d3c5667136134b20a8411803c97d` `3bc159537c909fa86bcc55eda127b5aa` `42a9f64e75911c167ec7a163e8b24920` `4a171f62d1bab01827b06ae73d4caafa` `66c6512b9a73425aba40c8bfa95d23a0` `6df909898f5f1394e78508d1152fab38` `6ee2be3e5558085b532dacc8db61f3e9` `6eea0568d5cc776ae03e09149cec3cd8` `765d3ce85a6393d05973c4cfa7738116` `90e0d27d808105167fdaa3a22b918217` `9e7b34e63d8d38e37667f88a945ae69a` `a02f28387527abe90d73d2879f671972` `abe12db77a62ecb99d6ab5dc4fff18c7` `de66cac88f156c3227749e03bdf7cf54` `e6650dc6721aaa27f8a289ff92e613ff` `e7c56b4f580da53cd0e4f11d1a11e402`
`com.mobile.applock.xk1`	`2de346602433cdd1668f36b2e9db0be1`
`appicon.diy.tools.prop`	`af16072864ae0f9d755f8cf00fded359` `e974cf4cc5d55cddc04f026dd3ea72b8` `ac8957a474f8aa812c7b233aafde4723`
`com.android.non.szcz`	`250205ee4b8de59e60c745856f439608`
`com.arabmusic.tap.aghani_tamerhosny`	`af7f1eef22bf5ee3d0a394f53ba7e1b8` `838dc8fcde1b28171e404ece1cfcde44`
`com.awht.zfip.zfyg`	`7322d8a65a56a7ab09f4d526cb343e3d`
`com.cool.weather.yl`	`0b8d3cd264c191f4884a25d0cc5318b5` `33b2d3ec9a35cfb0b5a5d7b24ce4140e` `3bb270d4927e2a8385793d9084a92fd3` `4e46549122c0236307c5eef8891466f5` `642d84ed5660407b972f1df642acb192` `9a3d04aa36654b5c4b21edd22e46f92d` `b7d0d5ae09b0d2d2f999c1087c450456` `cdfcc848e16660d607aba6ecf24567f4` `f0b7b1c940ebcee97eb68f528682fc50`
`com.dl.guard.lock`	`1150da1af88729e54a34b8da5a2741c7` `36f9e8cf47a28f9803fba427cf02a25c` `6739fe083cfa8dec9b4f989ccba0e99e` `ca7e2d265fc35aede432c4636a2cf4cb` `fcb9f38cc687fc8a4637e0acdf91ab66` `c8ea2a7c1f52c4c2474475c28373ee27`
`com.energy.appstore`	`c55c9d7e12cc273b812ceffca8f62d4b`
`com.fb.w.weather`	`9a46098de785ae732e5fced55a2f3063` `d145b14b9cc15799485f2592b2c16d9a`
`com.fe2bu1.wh`	`0a26a9d5f7ab91cb5eed852cf83ef078` `294ab3f586d76772ae89add417cf6324` `a13af0174bc211709e8b73bf60492a17` `b974ef4106af6b932df352563a9b8b3c` `e9ec6d7b50c1e54cd523283b9de55e10`
`com.message.recovery.prorestore`	`5400ffac371c5e5c9b7f3705ce9faca5` `92f2fd8bcccc8ec4ffa64c7f6b3b9b8d` `ab8d6be686ca9413e27a11e85f9cef1a`
`com.notemaster.record.mark`	`879168159c155758dbfd7a76e8f21548` `b6c5f7dfaf9d47cd67380a48df5e1731` `cb19dbf279a3488aec76c17e8e122c14` `fc812444baa071f5141ddad812d673de` `d6ba4044f9d57f7e86d83187982ed593`
`com.tst.blank`	`4f7d3c5859100d65ff02449884841b9c` `50e9cdc3ed145bbc688356eda07f8eb3` `9f1e2249003ab22cf8a38048e0ff6f6c`
`com.yun.wth.er`	`e39bddf592016ad6d0784770df3e2ffe`
`org.life.goal.tools`	`7469c9c06e5f324ca608e0140156bbad` `da67e37be01c20566990152ecfb14ed1`
`picturetranslate.extractor.text.lite`	`4521a5bbe0f33a15da86bd80ff5d6d9c` `8ec360829f4f7ae8dcae47c02b996762` `d56158a2cc8d13778df850907733b2c4` `836739fe7196437d8e998245b6f2b3b4`
`com.audify.editor.wavrge`	`fac6548a4a7a88156468b809c4f877f5`
`com.audify.editor.pro`	`cf4f24fdd283f80313565b08fea9d06d`
`com.prorestore.qr`	`3c098465af131141996ff840bd34e791`
`com.go.weather.mot`	`387f7af167530486adcf3d8546063462`
`com.dmstudio.weather`	`ee4e778e53ce4d4339d7c7888d06384d`

Additional MD5 Hashes Published in the Analysis

Associated package	MD5
`picturetranslate.extractor.text.lite`	`e250e5966c119a9098f7818fc6c080e5`
`appicon.diy.tools.prop`	`3b20edff1125e146aa3d5153708b58f4`
`com.dmstudio.weather`	`542ab80429ec42e8643dc645f58b716c`
`com.audify.editor.pro`	`145b806282d247441751bb4957b71606`
`com.mb.applock.a02`	`ee70ec99121f4d7c8b5a883e5ab3a858`
`com.solide.filemanager.lte`	`92390cacdd20d2ee5405093669e7302c`

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Midnight Mimosa Infects Android Phones Before Users Even Turn Them On appeared first on Cyber Security News.