Midnight Mimosa hides ad-fraud malware in cheap Android firmware
Original title: Hackers Turn Low-Cost Android Phones Into Hidden Proxy Botnets Through Preinstalled Malware
Bitdefender saw thousands of infected phones in more than 150 countries over about two years.
Bitdefender says Midnight Mimosa ships a platform-signed system app, com.android.system.lite, in firmware on low-cost MediaTek-based phones and counterfeit flagships. The implant decrypts remote plugins, silently installs apps and fabricates ad impressions and clicks. One package, com.mobile.applock.en, includes EnLoaderLib proxyware, but a dynamic test did not capture traffic relaying and a control endpoint was later a sinkhole. Removing visible apps is insufficient because the privileged enabler can reinstall payloads.
Unconfirmed: Supply-chain entry, certificate-owner involvement and actual proxy relaying are unconfirmed.
- Highest counts were Mexico, France and Italy; targeting was not confirmed.
- Researchers found at least 32 disguised apps and 13 related Google Play apps.
- The enabler briefly disables Play Store, assessed as an attempt to evade Play Protect.
- A Shenzhen Zediel certificate identifier does not prove where the firmware was compromised.
- Overlaps with Joker, Phantom, Click and BADBOX 2.0 do not establish shared ownership.
Impact: Phones used for ad fraud and possibly as residential proxies
| Product | Affected |
|---|---|
| MediaTek-based and counterfeit Android phones | — |
- 1.Assess trusted firmware remediation or hardware replacement; uninstalling apps leaves the enabler.
- 2.Treat unmanaged low-cost and BYOD Android phones as possible unauthorized network nodes.
- Vendors
- MediaTek
- Products
- Android
- Organizations
- Bitdefender
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | api.weatherlive.world | original firmware implant. Command infrastructure includes api.weatherlive.world, while additional modules are retrieved through infrastruct |
| domain | oss.showtimetool.com | onal modules are retrieved through infrastructure including oss.showtimetool.com. The weather-themed naming helps the malicious activity res |
| sha256 | 32b0dcb8429f6b049424ef08be58f641e2ba3b8292d38d0f7ebfdcd495b697df | 7c310c4491192cd87bc1a3e65297c2133819b2b4f672204787693f87b 5 32b0dcb8429f6b049424ef08be58f641e2ba3b8292d38d0f7ebfdcd495b697df 6 731634848622ba0b32b03d03766d01990c1ce63c85b5a701e15dd2a96 |
| sha256 | 55605320099d8b351e9c0fbbe0b9806058ba644de9c1f384914b4f1445a028e9 | ance on ordinary uninstall workflows alone. IOCs No. Hash 1 55605320099d8b351e9c0fbbe0b9806058ba644de9c1f384914b4f1445a028e9 2 97d37c33b2332072da7ca16d99ab047b64939745c82dab3b17e6b69f1 |
| sha256 | 731634848622ba0b32b03d03766d01990c1ce63c85b5a701e15dd2a96bd5f47e | 8429f6b049424ef08be58f641e2ba3b8292d38d0f7ebfdcd495b697df 6 731634848622ba0b32b03d03766d01990c1ce63c85b5a701e15dd2a96bd5f47e Note: IP addresses and domains are intentionally defanged ( |
| sha256 | 819f87c7c310c4491192cd87bc1a3e65297c2133819b2b4f672204787693f87b | c014eed0e59e4345021ec0e9e210edf364fffdb655baeb4dc6c058822 4 819f87c7c310c4491192cd87bc1a3e65297c2133819b2b4f672204787693f87b 5 32b0dcb8429f6b049424ef08be58f641e2ba3b8292d38d0f7ebfdcd49 |
| sha256 | 97d37c33b2332072da7ca16d99ab047b64939745c82dab3b17e6b69f14ad8ada | 0099d8b351e9c0fbbe0b9806058ba644de9c1f384914b4f1445a028e9 2 97d37c33b2332072da7ca16d99ab047b64939745c82dab3b17e6b69f14ad8ada 3 e1b600dc014eed0e59e4345021ec0e9e210edf364fffdb655baeb4dc6 |
| sha256 | e1b600dc014eed0e59e4345021ec0e9e210edf364fffdb655baeb4dc6c058822 | 3b2332072da7ca16d99ab047b64939745c82dab3b17e6b69f14ad8ada 3 e1b600dc014eed0e59e4345021ec0e9e210edf364fffdb655baeb4dc6c058822 4 819f87c7c310c4491192cd87bc1a3e65297c2133819b2b4f672204787 |
From the original article
3 min read at gbhackers.com
Midnight Mimosa, a widespread Android malware campaign, is turning inexpensive smartphones into advertising fraud engines and potential residential proxy nodes by embedding malicious apps in device firmware before purchase. Bitdefender observed thousands of infected devices across more than 150 countries over approximately two years, exposing a persistent compromise that ordinary application removal cannot resolve.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.