Malwarehigh
Midnight Mimosa malware ships in Android phone firmware
Original title: Thousands of Android Phones Ship With Hidden Malware That Disables Google Play Protections
AI summary · x-ai/grok-4.7Summaries by Vani AI
A platform-signed system app installs ad-fraud plugins after briefly disabling the Play Store; proxy use was not seen.
PolySwarm and Bitdefender describe Midnight Mimosa, malware preinstalled in low-cost Android firmware and observed on thousands of devices in more than 150 countries over about two years. A system app signed with an Android platform certificate can install or remove apps, load DEX or JAR plugins, and run advertising fraud. It temporarily disables the Google Play Store package before adding payloads. Researchers did not see permission abuse or live proxy traffic, and could not identify where the malware entered the supply chain.
Unconfirmed: Supply-chain entry, knowing involvement of Shenzhen Zediel, shared operators with Joker, Phantom, or Click, and real proxy use are unconfirmed.
Key facts
- Highest observed counts were in Mexico, France, and Italy, then the United States, Germany, Brazil, and Spain.
- Bitdefender found at least 32 disguised apps and 13 related Play Store ad-fraud apps.
- An initial control endpoint was later identified as a sinkhole.
- Named packages include com.android.system.lite and com.mobile.applock.en.
- Removing a visible app can leave the firmware enabler able to reinstall payloads.
Security assessment · AI, from the article
Impact: System access to install apps, run ad fraud, and open tunnels
| Product | Affected |
|---|---|
| Android phones | inexpensive MediaTek-based phones, counterfeit flagships, and devices tied to Doogee and Cubot |
What to do
- 1.Treat cleanup as a firmware problem; deleting visible apps may not remove the enabler.
- 2.Look for packages com.android.system.lite and com.mobile.applock.en and library libeasy.so.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1562.001 Impair Defenses: Disable or Modify ToolsT1105 Ingress Tool Transfer
- Vendors
- Products
- AndroidGoogle Play
- Malware
- Midnight Mimosa
- Organizations
- PolySwarmBitdefender
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | showtimetool.com | rlive[.]world Core enabler communications Download host oss.showtimetool[.]com Additional module delivery The source lists these 40 samp |
| domain | weatherlive.world | gistration and TCP tunneling Command-and-control domain api.weatherlive[.]world Core enabler communications Download host oss.showtimetoo |
| sha256 | 1b423665896a40d31bc7feec8b0fa78d7f27552fd25f4a72917519feed3e59f5 | 5c1a299ac58a0686c2d52547d43d3eb60fcf7a2fc9474f5752ebb8105 8 1b423665896a40d31bc7feec8b0fa78d7f27552fd25f4a72917519feed3e59f5 9 e33624c0d69bc71c68ce5b84757efcd27943757c24f14d2abbff1c564 |
| sha256 | 1ba97892f9631d0609116325eace408a4d2b28ff8f0639a4303b5cff2fb6b4f9 | 3583d37ae9eedac2665b09f656bd67f3985df0cdc0af9c7cd95bceed 39 1ba97892f9631d0609116325eace408a4d2b28ff8f0639a4303b5cff2fb6b4f9 40 3351728f6fba0c65d1c1c678e80c36ed7bdc8be1ea6bf85e826c27e6 |
| sha256 | 1fce280388341989856991b09d0a82b8872061b739641241bc30e57241a27dcb | 297cd5fbffe6caf57fed196e737c07075895cd26d93662c16c95c4fe 28 1fce280388341989856991b09d0a82b8872061b739641241bc30e57241a27dcb 29 4657191f26927e22018495a9e8da9044f76d0644d56eab0a553d57cc |
| sha256 | 1fe24e80eed64eb28ea1d31e949445eaa85095e33a03e6bc835d688b81f40875 | cd2c669dff3144f332013dd6db0aaf1115e6b04efcb4e25fea884fd2 11 1fe24e80eed64eb28ea1d31e949445eaa85095e33a03e6bc835d688b81f40875 12 f67f5a4415ca63037f6a543a900ca622d13b169fced6064d91e7082e |
| sha256 | 207758bad044c25f89fabf78892aa0f845a9b44a73b7aa16fd1fab1139c2297a | 180bc9d3c6755e6cd3ddb351c751e64c3bf346a1857cb2c1c7406483 36 207758bad044c25f89fabf78892aa0f845a9b44a73b7aa16fd1fab1139c2297a 37 6cb1b929dc98d6b1725fb4566a1b58bd3211c5da31697c962099ef58 |
| sha256 | 21d8ff68344b589d05626dce48a3b29573ee6c2e2a1ce81c392d69afd758c124 | 1ccd8dbad9c5e8f02da118caf1ead51fef0fcd4cebb311be3fd622a1 26 21d8ff68344b589d05626dce48a3b29573ee6c2e2a1ce81c392d69afd758c124 27 502090cf297cd5fbffe6caf57fed196e737c07075895cd26d93662c1 |
| sha256 | 245b0b9b3583d37ae9eedac2665b09f656bd67f3985df0cdc0af9c7cd95bceed | dc98d6b1725fb4566a1b58bd3211c5da31697c962099ef585b1e7853 38 245b0b9b3583d37ae9eedac2665b09f656bd67f3985df0cdc0af9c7cd95bceed 39 1ba97892f9631d0609116325eace408a4d2b28ff8f0639a4303b5cff |
| sha256 | 32b0dcb8429f6b049424ef08be58f641e2ba3b8292d38d0f7ebfdcd495b697df | 7c310c4491192cd87bc1a3e65297c2133819b2b4f672204787693f87b 5 32b0dcb8429f6b049424ef08be58f641e2ba3b8292d38d0f7ebfdcd495b697df 6 731634848622ba0b32b03d03766d01990c1ce63c85b5a701e15dd2a96 |
| sha256 | 3351728f6fba0c65d1c1c678e80c36ed7bdc8be1ea6bf85e826c27e689c3db07 | f9631d0609116325eace408a4d2b28ff8f0639a4303b5cff2fb6b4f9 40 3351728f6fba0c65d1c1c678e80c36ed7bdc8be1ea6bf85e826c27e689c3db07 Note: IP addresses and domains are intentionally defanged ( |
| sha256 | 3398bdb7180bc9d3c6755e6cd3ddb351c751e64c3bf346a1857cb2c1c7406483 | 9497fbc515b96eaea63c01d879895e1efc4b1ed71d58dd8e5aaf0284 35 3398bdb7180bc9d3c6755e6cd3ddb351c751e64c3bf346a1857cb2c1c7406483 36 207758bad044c25f89fabf78892aa0f845a9b44a73b7aa16fd1fab11 |
| sha256 | 3b8519d6412546c4c1c622e842e0d9b34a540169c974325d053ff227407133ad | 72b23acce491516c4d0eaa4291ff902199b806446587ed147dfd1a1e 16 3b8519d6412546c4c1c622e842e0d9b34a540169c974325d053ff227407133ad 17 70baca89bb6b76f26076c01c35cf531018064fe5ab3d6332312500e7 |
| sha256 | 4657191f26927e22018495a9e8da9044f76d0644d56eab0a553d57cc9735c63d | 88341989856991b09d0a82b8872061b739641241bc30e57241a27dcb 29 4657191f26927e22018495a9e8da9044f76d0644d56eab0a553d57cc9735c63d 30 771744786d0da8a530cbfe921408a3ddb11af797dff3ad9716d9b57e |
| sha256 | 468d2d12ededba0733acc32b4a0da776fac592cdc5fdf49015728f4586322b79 | 079dc2ffcff9fea9dccd23d9d206ffaede2274a2e6d8259c26b1a4a2 32 468d2d12ededba0733acc32b4a0da776fac592cdc5fdf49015728f4586322b79 33 e66d62bba82a5452fd9cb99a2b304c32f461cbc7f411a0fd555ae9db |
| sha256 | 4b3080c1cd2c669dff3144f332013dd6db0aaf1115e6b04efcb4e25fea884fd2 | d69bc71c68ce5b84757efcd27943757c24f14d2abbff1c564587c104 10 4b3080c1cd2c669dff3144f332013dd6db0aaf1115e6b04efcb4e25fea884fd2 11 1fe24e80eed64eb28ea1d31e949445eaa85095e33a03e6bc835d688b |
| sha256 | 502090cf297cd5fbffe6caf57fed196e737c07075895cd26d93662c16c95c4fe | 344b589d05626dce48a3b29573ee6c2e2a1ce81c392d69afd758c124 27 502090cf297cd5fbffe6caf57fed196e737c07075895cd26d93662c16c95c4fe 28 1fce280388341989856991b09d0a82b8872061b739641241bc30e572 |
| sha256 | 53e1d7dc079dc2ffcff9fea9dccd23d9d206ffaede2274a2e6d8259c26b1a4a2 | 6d0da8a530cbfe921408a3ddb11af797dff3ad9716d9b57ef7ab48b5 31 53e1d7dc079dc2ffcff9fea9dccd23d9d206ffaede2274a2e6d8259c26b1a4a2 32 468d2d12ededba0733acc32b4a0da776fac592cdc5fdf49015728f45 |
| sha256 | 543922608fa97dca7e13e70a8538ef60722d32069542551f218eafcee99e80fb | 93b4e434d231f00cb9ba16e6636792a96e21acf1be76f411dd1c5ed5 20 543922608fa97dca7e13e70a8538ef60722d32069542551f218eafcee99e80fb 21 a427a8e3bfeaa66f017535669905763d7af1cf2c394d8ba80ebe3f48 |
| sha256 | 55605320099d8b351e9c0fbbe0b9806058ba644de9c1f384914b4f1445a028e9 | t map individual hashes to specific packages. No. SHA-256 1 55605320099d8b351e9c0fbbe0b9806058ba644de9c1f384914b4f1445a028e9 2 97d37c33b2332072da7ca16d99ab047b64939745c82dab3b17e6b69f1 |
| sha256 | 58b95add72b23acce491516c4d0eaa4291ff902199b806446587ed147dfd1a1e | 4b3bc3f5d44b278568bae8933e36cddb4e9074ad1b29a64e7c197e26 15 58b95add72b23acce491516c4d0eaa4291ff902199b806446587ed147dfd1a1e 16 3b8519d6412546c4c1c622e842e0d9b34a540169c974325d053ff227 |
| sha256 | 5cd66605c1a299ac58a0686c2d52547d43d3eb60fcf7a2fc9474f5752ebb8105 | 48622ba0b32b03d03766d01990c1ce63c85b5a701e15dd2a96bd5f47e 7 5cd66605c1a299ac58a0686c2d52547d43d3eb60fcf7a2fc9474f5752ebb8105 8 1b423665896a40d31bc7feec8b0fa78d7f27552fd25f4a72917519fee |
| sha256 | 63d2417f93b4e434d231f00cb9ba16e6636792a96e21acf1be76f411dd1c5ed5 | 954d404789f652040d761b07e12aaae0129dc6c25ec1732afc5d92f3 19 63d2417f93b4e434d231f00cb9ba16e6636792a96e21acf1be76f411dd1c5ed5 20 543922608fa97dca7e13e70a8538ef60722d32069542551f218eafce |
| sha256 | 6cb1b929dc98d6b1725fb4566a1b58bd3211c5da31697c962099ef585b1e7853 | d044c25f89fabf78892aa0f845a9b44a73b7aa16fd1fab1139c2297a 37 6cb1b929dc98d6b1725fb4566a1b58bd3211c5da31697c962099ef585b1e7853 38 245b0b9b3583d37ae9eedac2665b09f656bd67f3985df0cdc0af9c7c |
| sha256 | 70baca89bb6b76f26076c01c35cf531018064fe5ab3d6332312500e7c1def9e1 | 412546c4c1c622e842e0d9b34a540169c974325d053ff227407133ad 17 70baca89bb6b76f26076c01c35cf531018064fe5ab3d6332312500e7c1def9e1 18 d434d6cb954d404789f652040d761b07e12aaae0129dc6c25ec1732a |
| sha256 | 731634848622ba0b32b03d03766d01990c1ce63c85b5a701e15dd2a96bd5f47e | 8429f6b049424ef08be58f641e2ba3b8292d38d0f7ebfdcd495b697df 6 731634848622ba0b32b03d03766d01990c1ce63c85b5a701e15dd2a96bd5f47e 7 5cd66605c1a299ac58a0686c2d52547d43d3eb60fcf7a2fc9474f5752 |
| sha256 | 771744786d0da8a530cbfe921408a3ddb11af797dff3ad9716d9b57ef7ab48b5 | 26927e22018495a9e8da9044f76d0644d56eab0a553d57cc9735c63d 30 771744786d0da8a530cbfe921408a3ddb11af797dff3ad9716d9b57ef7ab48b5 31 53e1d7dc079dc2ffcff9fea9dccd23d9d206ffaede2274a2e6d8259c |
| sha256 | 819f87c7c310c4491192cd87bc1a3e65297c2133819b2b4f672204787693f87b | c014eed0e59e4345021ec0e9e210edf364fffdb655baeb4dc6c058822 4 819f87c7c310c4491192cd87bc1a3e65297c2133819b2b4f672204787693f87b 5 32b0dcb8429f6b049424ef08be58f641e2ba3b8292d38d0f7ebfdcd49 |
| sha256 | 880c7c369497fbc515b96eaea63c01d879895e1efc4b1ed71d58dd8e5aaf0284 | a82a5452fd9cb99a2b304c32f461cbc7f411a0fd555ae9db6ce34eec 34 880c7c369497fbc515b96eaea63c01d879895e1efc4b1ed71d58dd8e5aaf0284 35 3398bdb7180bc9d3c6755e6cd3ddb351c751e64c3bf346a1857cb2c1 |
| sha256 | 88ee3c961ccd8dbad9c5e8f02da118caf1ead51fef0fcd4cebb311be3fd622a1 | e1007ec143200d8192589593c22b6cf143ac51b320eabf08260ab2d4 25 88ee3c961ccd8dbad9c5e8f02da118caf1ead51fef0fcd4cebb311be3fd622a1 26 21d8ff68344b589d05626dce48a3b29573ee6c2e2a1ce81c392d69af |
| sha256 | 8f35a3844b3bc3f5d44b278568bae8933e36cddb4e9074ad1b29a64e7c197e26 | 8f77fca773d97b86c9a3122ef5e4991a6e70f901c64672cff8bf3956 14 8f35a3844b3bc3f5d44b278568bae8933e36cddb4e9074ad1b29a64e7c197e26 15 58b95add72b23acce491516c4d0eaa4291ff902199b806446587ed14 |
| sha256 | 97d37c33b2332072da7ca16d99ab047b64939745c82dab3b17e6b69f14ad8ada | 0099d8b351e9c0fbbe0b9806058ba644de9c1f384914b4f1445a028e9 2 97d37c33b2332072da7ca16d99ab047b64939745c82dab3b17e6b69f14ad8ada 3 e1b600dc014eed0e59e4345021ec0e9e210edf364fffdb655baeb4dc6 |
| sha256 | 980ee11f141ca4983c2e5457d48a994a61aa5a537c60d89a0999ce8a69996e0f | bfeaa66f017535669905763d7af1cf2c394d8ba80ebe3f489e2bb54f 22 980ee11f141ca4983c2e5457d48a994a61aa5a537c60d89a0999ce8a69996e0f 23 bcad5575a549137af0e44463b3cdda315848ed93c2ca6acf486dbc20 |
| sha256 | a12844e4e1007ec143200d8192589593c22b6cf143ac51b320eabf08260ab2d4 | a549137af0e44463b3cdda315848ed93c2ca6acf486dbc20c4f57f0c 24 a12844e4e1007ec143200d8192589593c22b6cf143ac51b320eabf08260ab2d4 25 88ee3c961ccd8dbad9c5e8f02da118caf1ead51fef0fcd4cebb311be |
| sha256 | a427a8e3bfeaa66f017535669905763d7af1cf2c394d8ba80ebe3f489e2bb54f | 8fa97dca7e13e70a8538ef60722d32069542551f218eafcee99e80fb 21 a427a8e3bfeaa66f017535669905763d7af1cf2c394d8ba80ebe3f489e2bb54f 22 980ee11f141ca4983c2e5457d48a994a61aa5a537c60d89a0999ce8a |
| sha256 | bcad5575a549137af0e44463b3cdda315848ed93c2ca6acf486dbc20c4f57f0c | 141ca4983c2e5457d48a994a61aa5a537c60d89a0999ce8a69996e0f 23 bcad5575a549137af0e44463b3cdda315848ed93c2ca6acf486dbc20c4f57f0c 24 a12844e4e1007ec143200d8192589593c22b6cf143ac51b320eabf08 |
| sha256 | c38714cd8f77fca773d97b86c9a3122ef5e4991a6e70f901c64672cff8bf3956 | 15ca63037f6a543a900ca622d13b169fced6064d91e7082e8557b53c 13 c38714cd8f77fca773d97b86c9a3122ef5e4991a6e70f901c64672cff8bf3956 14 8f35a3844b3bc3f5d44b278568bae8933e36cddb4e9074ad1b29a64e |
| sha256 | d434d6cb954d404789f652040d761b07e12aaae0129dc6c25ec1732afc5d92f3 | bb6b76f26076c01c35cf531018064fe5ab3d6332312500e7c1def9e1 18 d434d6cb954d404789f652040d761b07e12aaae0129dc6c25ec1732afc5d92f3 19 63d2417f93b4e434d231f00cb9ba16e6636792a96e21acf1be76f411 |
| sha256 | e1b600dc014eed0e59e4345021ec0e9e210edf364fffdb655baeb4dc6c058822 | 3b2332072da7ca16d99ab047b64939745c82dab3b17e6b69f14ad8ada 3 e1b600dc014eed0e59e4345021ec0e9e210edf364fffdb655baeb4dc6c058822 4 819f87c7c310c4491192cd87bc1a3e65297c2133819b2b4f672204787 |
| sha256 | e33624c0d69bc71c68ce5b84757efcd27943757c24f14d2abbff1c564587c104 | 5896a40d31bc7feec8b0fa78d7f27552fd25f4a72917519feed3e59f5 9 e33624c0d69bc71c68ce5b84757efcd27943757c24f14d2abbff1c564587c104 10 4b3080c1cd2c669dff3144f332013dd6db0aaf1115e6b04efcb4e25f |
| sha256 | e66d62bba82a5452fd9cb99a2b304c32f461cbc7f411a0fd555ae9db6ce34eec | ededba0733acc32b4a0da776fac592cdc5fdf49015728f4586322b79 33 e66d62bba82a5452fd9cb99a2b304c32f461cbc7f411a0fd555ae9db6ce34eec 34 880c7c369497fbc515b96eaea63c01d879895e1efc4b1ed71d58dd8e |
| sha256 | f67f5a4415ca63037f6a543a900ca622d13b169fced6064d91e7082e8557b53c | eed64eb28ea1d31e949445eaa85095e33a03e6bc835d688b81f40875 12 f67f5a4415ca63037f6a543a900ca622d13b169fced6064d91e7082e8557b53c 13 c38714cd8f77fca773d97b86c9a3122ef5e4991a6e70f901c64672cf |
From the original article
4 min read at cybersecuritynews.com
Thousands of Android phones across more than 150 countries have been found running malware planted in their firmware before purchase. The campaign, called Midnight Mimosa, targets low-cost devices and gives attackers system access without requiring owners to download a harmful app or click a suspicious link. The malware can secretly install and remove apps, load […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.