Midnight Mimosa Malware Campaign Exploits Android Firmware Supply Chain

Midnight Mimosa is an Android malware campaign that compromises the supply chain of MediaTek-based devices by preinstalling malicious applications in device firmware. These platform-signed system applications enable the malware to silently deploy payloads, evade mobile security protections, and execute code remotely. The malware maintains persistence at the system level before device activation and bypasses Google Play Store protections temporarily to avoid detection. Operators rotate payloads remotely to maintain privileged access. The campaign monetizes infected devices through advertising fraud and residential proxy services. The campaign has been observed globally, with notable infection concentrations in Mexico, France, and Italy. Affected devices include low-cost Android handsets, counterfeit flagship models, and devices associated with Doogee and Cubot brands.

The malware provides persistent system-level access on compromised devices, allowing operators to execute arbitrary code remotely and evade conventional Android security controls. This leads to unauthorized use of device resources for advertising fraud and residential proxy services, potentially impacting device performance, user privacy, and network security. The infection is difficult to detect and remove due to its integration in firmware and platform-signed system apps, and it can affect devices before user activation.

No specific patch or remediation is indicated in the provided data. Since the malware is preinstalled in device firmware, remediation typically requires firmware updates from device manufacturers or replacement of affected devices. Users should avoid purchasing low-cost or counterfeit devices from untrusted sources. Mobile security solutions may have limited effectiveness due to the malware's system-level persistence and platform-signed status. Monitor vendor advisories for firmware updates or official remediation guidance.