Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue

Midnight Mimosa, an Android malware campaign embedded in firmware that monetizes compromised smartphones through advertising fraud and residential proxy services.

Disclosed on October 8, the operation affected thousands of devices across more than 150 countries over roughly two years, predominantly inexpensive phones built on MediaTek platforms.

Unlike malware requiring a malicious download, Midnight Mimosa arrives before the device reaches its owner.

Its privileged system component silently installs and removes applications, grants permissions, and retrieves executable code.

The entry point into the hardware supply chain remains unknown; the findings do not establish that MediaTek introduced the infection.

Related implementations appeared as com.android.sys.prot, com.android.sys.gmsprot, and com.android.sys.bcprot.

These names imitate legitimate Android components, but researchers identified shared malicious functionality rather than treating any individual package name as a definitive detection signature.

A native library, libeasy.so, decrypts a concealed framework that retrieves remote configuration from infrastructure masquerading as a weather service. Additional plugins enable silent installation and advertising.

Downloaded files use misleading extensions, including JAR components labeled .o and APK payloads served as .png, complicating static inspection of initial samples.

The malware repeatedly manipulates Accessibility, Notification Access, and SMS permissions. Researchers did not observe abuse of the notification or SMS privileges, making those capabilities a potential risk rather than confirmed surveillance.

Before some payload installations, it temporarily turns off com.android.vending, the Google Play Store package, apparently to evade Play Protect checks.

Bitdefender Researchers said that, the investigation began when behavioral detection flagged com.android.system.lite, an iconless package labeled “System.”

Android Firmware Malware

Bitdefender identified at least 32 dropped applications disguised as weather tools, app lockers, note utilities, file managers, and other useful software.

These cover applications load genuine advertisements through legitimate advertising services, while hidden windows produce impressions without visible user engagement.

The geographic distribution is led by Mexico, France and Italy, followed by the United States, Germany, Brazil and Spain.

Additional components generate synthetic clicks, converting covert activity into revenue.

Advertising plugins can trigger unwanted activities and overlays when the screen activates or operators issue commands. Secure window flags prevent those surfaces from appearing in screenshots or recordings.

Timing restrictions and daily click limits make automated interactions appear less conspicuous, while cooperating applications distribute advertising activity across the deployed payload ecosystem.

A separate payload, com.mobile.applock.en, operates as a TCP proxy without advertisements or a user interface.

It connects over port 6000 and relays traffic to destinations selected remotely, turning the victim’s connection into residential proxy infrastructure.

Researchers described potential botnet and DDoS applications, not evidence of a documented DDoS campaign.

Thirteen Google Play applications also communicated with the operation’s infrastructure and contained matching advertising fraud code.

Unlike firmware implants, these applications lacked equivalent system privileges and offered genuine functionality.

Their presence demonstrates that the operators combined privileged preinstallation with conventional store distribution rather than relying exclusively on compromised firmware.

Some affected firmware carried certificates associated with Shenzhen Zediel, but certificate attribution does not prove authorship, knowledge, or deliberate distribution.

Shared infrastructure also connected the investigation to previously reported Android.Joker, Android.Phantom, and Click activity; these historical overlaps should not be mistaken for confirmed attribution to a named threat actor.

Because the persistent component resides in the system partition, ordinary uninstallation cannot remove it.

Effective remediation requires trusted firmware cleanup or vendor intervention. Defenders should prioritize behavioral monitoring and validated firmware provenance rather than package name blocklists alone for these compromised devices.

Indicators of compromise

Type	Indicator	Context
Host	api.weatherlive[.]world/br_upgrade/upgradeV2/getConfigs	AES/HmacMD5 module control channel
Host	api.weatherlive[.]world/odborwer_dot/cm	Telemetry beacon (DotReporter)
Host	oss.showtimetool[.]com	Module/asset CDN (payloads served as .png)
Host	39.96.8.180:9008/ssc/rprt/bug	DX/S1 framework bug-report C2
Host	120.78.215.151:80/api/bugLog	Embedded-framework crash C2

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.