Midnight Mimosa (Malware): news timeline & CVEs

Low-cost Android phones ship with residential proxy malware

Midnight Mimosa malware preinstalled on cheap Android phones enables ad fraud and residential proxy abuse.

Bitdefender reported Midnight Mimosa, malware embedded in the firmware of low-cost Android phones using MediaTek chipsets. Privileged apps masquerading as system packages can silently install software, temporarily disable the Play Store, and download modules from command-and-control servers. Cover apps generate fraudulent ad impressions in hidden windows, and an app-locker component can register phones as residential proxies. Thousands of devices in more than 150 countries were affected over about two years, including Doogee and Cubot models, and 13 Play Store apps shared the fraud code.

BleepingComputer19:20 UTC · 4h agoMalware in the wild 3 sources

The phone was compromised before the user turned it on: the rise of Midnight Mimosa

Bitdefender found preinstalled Midnight Mimosa malware on low-cost Android phones, enabling fraud, proxies, and remote control.

Bitdefender identified Midnight Mimosa, malware preinstalled in firmware on low-cost Android devices built on MediaTek platforms. Platform-signed system packages such as com.android.system.lite can silently install or remove apps, grant permissions, and load remote code, and users cannot uninstall them. Dropped cover apps conduct hidden ad and click fraud or turn devices into residential-proxy botnet nodes, using command-and-control disguised as a weather API. Thirteen Google Play apps under at least two developer accounts communicate with the same servers.

Bitdefender Labsupdated 19:20 UTC · 4h agofirst 12:57 UTC · 10h agoMalware in the wild 3 sources1

Midnight Mimosa

Timeline2 articles

Appears with

Low-cost Android phones ship with residential proxy malware

The phone was compromised before the user turned it on: the rise of Midnight Mimosa