The phone was compromised before the user turned it on: the rise of Midnight Mimosa

Midnight Mimosa is a preinstalled firmware malware campaign targeting MediaTek-based low-cost Android devices. The malware runs as a platform-signed system app with elevated privileges, enabling operators to silently install additional apps, grant permissions, and execute remote code. It masquerades under system-sounding package names such as com.android.system.lite and com.android.sys.prot. The campaign's monetization methods include ad fraud, click fraud, device information harvesting, and leveraging infected devices as residential proxy botnet nodes. During payload installation, the malware disables the Google Play Store to avoid detection and re-enables it afterward. At least 32 disguised malicious apps are deployed, including fake utilities like weather and OCR tools. Thirteen related apps were also identified on Google Play, communicating with the same command-and-control servers.

The malware compromises device integrity by operating with system-level privileges, enabling stealthy installation of malicious applications and remote code execution. This leads to unauthorized ad and click fraud generating illicit revenue, extensive device data collection, and the transformation of infected devices into nodes within a residential proxy botnet. The disabling of Google Play Store during payload installation increases the difficulty of detection and removal by users or security tools. The presence of related apps on Google Play indicates a broader infection vector and potential for widespread impact.

No official patch or remediation is indicated. Since the malware is preinstalled in device firmware, removal is challenging and may require reflashing the device with clean firmware or replacing the device. Users should avoid purchasing low-cost Android devices from untrusted sources, especially those using MediaTek platforms. Monitoring for suspicious system applications with names like com.android.system.lite or com.android.sys.prot may help identify infections. The presence of related malicious apps on Google Play suggests caution when installing apps, even from official stores. Vendors and security researchers should investigate firmware supply chains to prevent preinstallation of such malware.