Midnight Mimosa Infects Android Phones Before Users Even Turn Them On
Midnight Mimosa ships in low-cost Android firmware, silently running ad fraud and proxy modules before first boot.
Bitdefender reported Midnight Mimosa, Android malware preinstalled in firmware on low-cost MediaTek devices, affecting thousands of phones in more than 150 countries over about two years. A platform-signed system component decrypts an embedded APK with RC4, loads further DEX and JAR modules, and rotates at least 32 cover apps for fake ad clicks and possible residential-proxy enrollment. Mexico, France, and Italy led observed detections. Normal uninstall cannot remove the firmware component; researchers did not observe data theft or live proxy relay, and one suspected command server was a sinkhole.
- Firmware-resident malware hits low-cost MediaTek Android phones in 150-plus countries.
- Bitdefender saw thousands of infections; Mexico, France, and Italy led detections.
- Operators run ad-click fraud and can enroll phones as residential proxies.
- A system component rotates cover apps and cannot be uninstalled normally.
- Play Store is toggled off to evade Play Protect; theft was not observed.
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| md5 | 0377ca97ac0ca35f9134052fede67a81 | 5b53 b3a4405d1b8d43545d07b10581008d32 com.android.gallery3d 0377ca97ac0ca35f9134052fede67a81 0b0d8e995e6ff24d4e9d00417446c25e 1414d4ef2d1191080abc59a407 |
| md5 | 05ae89e761a890fa24f80f4be7263651 | es Android package Published MD5 hashes com.android.browser 05ae89e761a890fa24f80f4be7263651 1da42505f1c83959c7f901f5139a158e a147cd8f72aadfcf78f7723db6 |
| md5 | 079298a7a506b376def4f4ff9a250672 | 916f f602230f54507cbddf5ef3014737d768 com.mobile.applock.wt 079298a7a506b376def4f4ff9a250672 20cefb2c667f945d482daded7e698eea 254bc5f6f81de1f3c47534e6fe |
| md5 | 08d231c6a5303e543eb60d4181f6a4ea | k.ea cde0490e11db8ad54737c1df59ec658b com.mobile.applock.en 08d231c6a5303e543eb60d4181f6a4ea 7f7747575980098bdc98e7b7aa362697 d3faec4f013c4a1e84a1d68144 |
| md5 | 0903d7fd3e1d4a599a7eb3c5d356779b | weapps ed1a6bed83899952b464c27aef9752cc com.android.weiapps 0903d7fd3e1d4a599a7eb3c5d356779b com.mb.applock.a02 a57a1ba15364dfb35d334f644d7049e8 com.mb. |
| md5 | 0a26a9d5f7ab91cb5eed852cf83ef078 |
Full article1,420 words · extracted from cybersecuritynews.com · click to collapse
Midnight Mimosa is reaching Android phones before their owners even press the power button. The malware arrives inside device firmware, giving its operators a hidden foothold that does not depend on a malicious download, a phishing link, or someone accepting an app permission request.
The campaign affects low-cost Android devices from several brands built on MediaTek platforms. Its main purpose appears to be making money through fake advertising activity and residential proxy services, while its system access also allows operators to install apps, remove them, and load new code without asking users.
Researchers from Bitdefender identified Midnight Mimosa after their App Anomaly Detection technology flagged a system package behaving unlike a normal Android component.
The detailed malware research report by Bitdefender, published October 8 and updated October 9, describes thousands of affected devices across more than 150 countries during a roughly two-year observation window.
Mexico, France, and Italy led the observed distribution, followed by the United States, Germany, Brazil, and Spain. These findings reflect Bitdefender’s visibility, not a complete global infection count.
Some phones also reported counterfeit flagship names, meaning their model labels cannot reliably identify the hardware or its actual manufacturer.
Midnight Mimosa Infects Android Phones
The investigation started with a hidden component labelled “System.” Signed with a platform certificate and running under Android’s system user, it could install packages and grant permissions silently.
.webp)
Unlike an ordinary downloaded app, this firmware component could not be removed through the phone’s normal uninstall controls. This delivery method puts the problem inside the device supply chain rather than placing responsibility on the owner.
Earlier cases involving preinstalled Android firmware malware show why reviewing downloaded apps alone cannot protect a phone that already contains a trusted but harmful system component when it leaves the seller.
The malware hides much of its code in a native library. During startup, that library decrypts an embedded APK using RC4 and loads a hidden Java framework.
The framework then downloads further DEX and JAR modules, allowing the operators to change the phone’s behavior after purchase. Those modules handle fake ad clicks, app installation, and additional downloads.
Some JAR files are stored with an object-file extension, while downloadable modules are served as PNG files. These layers make the original APK a poor guide to what the malware will eventually do on a working device.
Bitdefender found at least 32 disguised apps in the wider operation, including weather tools, app locks, file managers, and text scanners.
The system component repeatedly installs and removes these payloads. That rotation changes the visible app inventory while leaving the main firmware infection in place.
Advertising revenue comes through ordinary-looking cover apps carrying a legitimate advertising SDK. Hidden activity creates impressions and clicks without real user input, with timing limits intended to make traffic look natural.
The related Android Phantom click fraud research offers useful background on similar tools and infrastructure identified in this investigation.
.webp)
A separate fake app-lock payload can enroll the phone as a residential proxy, letting a remote operator route traffic through its connection.
Earlier research into BADBOX Android proxy malware illustrates the wider risk of consumer devices becoming network relays. However, Bitdefender did not observe traffic being relayed during its fresh-node test.
Before installing payloads, the malware disables the Google Play Store package, apparently to avoid detection by Play Protect, and then enables it again.
It also restores the store when the user is present. Some samples falsely record Google Play as their installer, despite lacking Google’s distribution signature block.
Researchers also found the same ad-fraud code in 13 Google Play apps. Those store builds lacked the system powers of the preinstalled malware but still displayed ads outside their normal interface.
Previous reporting on Google Play advertising fraud shows why official distribution alone does not guarantee harmless behavior. The system component requests sensitive access involving Accessibility, notifications, and SMS.
Researchers observed repeated enabling and disabling of Accessibility and Notification Access, but did not see those capabilities used for theft. Their presence, combined with remote code loading, leaves room for operators to expand the campaign beyond advertising fraud.
Some affected firmware used certificates bearing Shenzhen Zediel’s name, but Bitdefender did not establish that the company created, approved, or knowingly distributed the malware.
The point where it entered the supply chain remains unknown. Durable cleanup requires firmware-level work; normal uninstall methods cannot remove the root component.
Vendors and sellers therefore hold a central role in fixing affected devices. Crucially, the report corrects one network finding: an address first described as a proxy command server was actually a sinkhole, not confirmed attacker infrastructure.
Indicators of compromise (IoCs)
Network, File, and Detection Indicators
| Type | Indicator | Context |
|---|---|---|
| Control endpoint | api.weatherlive[.]world/br_upgrade/upgradeV2/getConfigs | Encrypted module configuration and control channel. |
| Telemetry endpoint | api.weatherlive[.]world/odborwer_dot/cm | Device telemetry and fabricated advertising events. |
| Download host | oss.showtimetool[.]com | Module and asset delivery; payloads served with .png extensions. |
| Reporting endpoint | 39.96.8.180:9008/ssc/rprt/bug | DX/S1 framework bug-report endpoint. |
| Reporting endpoint | 120.78.215.151:80/api/bugLog | Embedded-framework crash-report endpoint. |
| Proxy host pattern | {productId}.apple.<domain>:6000 | Proxyware control-host construction. |
| Proxy domain | 0aa0cf0637d66c0d[.]com | Domain in the proxyware host rotation. |
| Proxy domain | aa86a52a98162b7d[.]com | Domain in the proxyware host rotation. |
| Proxy domain | 442fe7151fb1e9b5[.]com | Domain in the proxyware host rotation. |
| Proxy domain | v46wd6uramzkmeeo[.]in | Domain in the proxyware host rotation. |
| Related infrastructure | cgb.jingongbuxiao[.]com | Shared indicator cited in the Android.Phantom operator-lineage analysis. |
| Related endpoint | 5.ahd187[.]com/thirdsdk/flowcashpack/ | Shared Android.Phantom-related download infrastructure. |
| Historical related domain | zhuifengzhe[.]top | Infrastructure connecting earlier Joker and Phantom research. |
| Related host | fyapi.freeflightbird[.]com | Host listed in the Phantom/Click lineage. |
| Related host | newsadapi.zhuifengzhe[.]top | Host listed in the Phantom/Click lineage. |
| Native library | libeasy.so | Native core that decrypts and drops the hidden framework. |
| Native-library MD5 | a8847b68428fde206b6dff8001051f92 | MD5 published for libeasy.so. |
| Renamed native library | libunionprt.so | Native core name used by a confirmed variant. |
| Framework namespace | cn.kw.lib.hex | Hidden framework dropped by the native core. |
| Loader/files | cn.kw.lib.dx.DxFactory; kwlib.jar; kwlib.next | Remote framework loading and update artifacts. |
| Plugin files | files/plg/<md5-id>/magic.o; magic.o.info | JAR plugin and its descriptor; angle-bracket value is variable. |
| Bundled payload | assets/mediaapp-release.apk | Partner APK embedded inside stage-three plugins. |
| Plugin classes | com.wz.sdk.DxFactory; com.earnsdk.lib.DxFactory; com.gogo.third.lib.DxFactory | Ad-fraud and silent-install modules. |
| Payload markers | EnLoaderLib v1.0.6; com.ctr.cbd | Proxyware loader and separate ad-fraud module. |
| Service marker | com.media.am.intent.action.BIND_SERVICE; MyDataService | Communication between cover apps in the advertising mesh. |
| Install-source marker | Installer recorded as com.android.vending, without Play “frosting” | Forged Google Play provenance in identified samples. |
| Device-context marker | Wi-Fi MAC prefix A0:53:94 | Zediel-associated allocation; not proof of infection by itself. |
| Partial certificate marker | 0105bc4c… | Published platform-certificate prefix, not a complete hash or proof of company involvement. |
| String cipher | AES-128-CFB; key derived with MD5("aGV4QCFRQFcjRQ=="); IV 0102030405060708 | Hidden-framework string encryption. |
| String cipher | AES-128-CFB; key derived with MD5("dHhAZXhAc2Vy") | Enabler string encryption. |
| String cipher | AES/CFB; key derived with MD5("ZHhAIVFAVyNF") | Stage-three plugin string encryption. |
Corrected Infrastructure Finding
| Indicator | Corrected status | Handling note |
|---|---|---|
85.17.70.38:6000 | Sinkhole | Bitdefender initially described this address as live proxyware C2, then corrected that finding. Do not label it confirmed attacker-controlled infrastructure. |
Complete Published Sample Set: 120 MD5 Hashes
| Android package | Published MD5 hashes |
|---|---|
com.android.browser | 05ae89e761a890fa24f80f4be72636511da42505f1c83959c7f901f5139a158ea147cd8f72aadfcf78f7723db6813e86f456f0c6b89bd3d5124699d43971d094 |
com.android.deskclock | 2c77653b889dfccd649b82446f8c0d1b5d29e9b24708c3ec36d1d59036124838998e9010e5dfc4e4645f5572cbbe5b53b3a4405d1b8d43545d07b10581008d32 |
com.android.gallery3d | 0377ca97ac0ca35f9134052fede67a810b0d8e995e6ff24d4e9d00417446c25e1414d4ef2d1191080abc59a407dcb6c5345057421c7d9ac2b671c47449f3503036deebfcda4012d18706cd170c1edf1f37f18a20b9cf32e6f07450e903eaad7c4507363415e7dc6d2cab14eeed137f6c512a6db4a22244272826f39da020fb445b3a49938f455d1197736971c4c072286aca76699ec0bb8e51372d5c68c8359b815b910f1efc95f38ba0c5b12c4f2129c75ec7f3bcbc879aae9a21ad544d3232d9fc6b2cd5eaa3929207f1029663d947e51c11442a529dcd06dc7c8e45974ec2e9b91e1d94bb3ff9a1c00b1c13eb7960 |
com.android.settings | be22c91b4578ac2357a16133615df335 |
com.android.sys.bcprot | d5d88214170875386ab855172f881e51dce5b0dc0e7d7059b5ab8384a7c24ec4 |
com.android.sys.dts | 61aac6a98abd6dcff0dc41bb88159786 |
com.android.sys.gmsprot | 2b784622422f4280e0b3e38b30dd87bc |
com.android.sys.prot | 2b7f1a7d5f5515c05d0c8e3857155ae23d3358b1057b1bfbd7e60577d8a31e0c7400c34f7c6f866499029f5e759f58bdd4ceb05682ecd60f4ebb4e76e02fcf7d |
com.android.system.lite | 60bc23d3d453f258e2c4ca421cd086a9b862681953e945439167a736ba4cd41b |
com.android.weapps | ed1a6bed83899952b464c27aef9752cc |
com.android.weiapps | 0903d7fd3e1d4a599a7eb3c5d356779b |
com.mb.applock.a02 | a57a1ba15364dfb35d334f644d7049e8 |
com.mb.applock.ea | cde0490e11db8ad54737c1df59ec658b |
com.mobile.applock.en | 08d231c6a5303e543eb60d4181f6a4ea7f7747575980098bdc98e7b7aa362697d3faec4f013c4a1e84a1d681448312c0 |
com.mobile.applock.tg | e75e183027bf897eda6447366c7acd01 |
com.mobile.applock.wg | 20108557cacd24263e7e611afc327801aac942aaf6ec0773cbac87fde4a6b284cf20de9d9ddc952bb2265002d26a916ff602230f54507cbddf5ef3014737d768 |
com.mobile.applock.wt | 079298a7a506b376def4f4ff9a25067220cefb2c667f945d482daded7e698eea254bc5f6f81de1f3c47534e6febaf02331b3280f1c0836c39c470932cf6c3e6f3b35d3c5667136134b20a8411803c97d3bc159537c909fa86bcc55eda127b5aa42a9f64e75911c167ec7a163e8b249204a171f62d1bab01827b06ae73d4caafa66c6512b9a73425aba40c8bfa95d23a06df909898f5f1394e78508d1152fab386ee2be3e5558085b532dacc8db61f3e96eea0568d5cc776ae03e09149cec3cd8765d3ce85a6393d05973c4cfa773811690e0d27d808105167fdaa3a22b9182179e7b34e63d8d38e37667f88a945ae69aa02f28387527abe90d73d2879f671972abe12db77a62ecb99d6ab5dc4fff18c7de66cac88f156c3227749e03bdf7cf54e6650dc6721aaa27f8a289ff92e613ffe7c56b4f580da53cd0e4f11d1a11e402 |
com.mobile.applock.xk1 | 2de346602433cdd1668f36b2e9db0be1 |
appicon.diy.tools.prop | af16072864ae0f9d755f8cf00fded359e974cf4cc5d55cddc04f026dd3ea72b8ac8957a474f8aa812c7b233aafde4723 |
com.android.non.szcz | 250205ee4b8de59e60c745856f439608 |
com.arabmusic.tap.aghani_tamerhosny | af7f1eef22bf5ee3d0a394f53ba7e1b8838dc8fcde1b28171e404ece1cfcde44 |
com.awht.zfip.zfyg | 7322d8a65a56a7ab09f4d526cb343e3d |
com.cool.weather.yl | 0b8d3cd264c191f4884a25d0cc5318b533b2d3ec9a35cfb0b5a5d7b24ce4140e3bb270d4927e2a8385793d9084a92fd34e46549122c0236307c5eef8891466f5642d84ed5660407b972f1df642acb1929a3d04aa36654b5c4b21edd22e46f92db7d0d5ae09b0d2d2f999c1087c450456cdfcc848e16660d607aba6ecf24567f4f0b7b1c940ebcee97eb68f528682fc50 |
com.dl.guard.lock | 1150da1af88729e54a34b8da5a2741c736f9e8cf47a28f9803fba427cf02a25c6739fe083cfa8dec9b4f989ccba0e99eca7e2d265fc35aede432c4636a2cf4cbfcb9f38cc687fc8a4637e0acdf91ab66c8ea2a7c1f52c4c2474475c28373ee27 |
com.energy.appstore | c55c9d7e12cc273b812ceffca8f62d4b |
com.fb.w.weather | 9a46098de785ae732e5fced55a2f3063d145b14b9cc15799485f2592b2c16d9a |
com.fe2bu1.wh | 0a26a9d5f7ab91cb5eed852cf83ef078294ab3f586d76772ae89add417cf6324a13af0174bc211709e8b73bf60492a17b974ef4106af6b932df352563a9b8b3ce9ec6d7b50c1e54cd523283b9de55e10 |
com.message.recovery.prorestore | 5400ffac371c5e5c9b7f3705ce9faca592f2fd8bcccc8ec4ffa64c7f6b3b9b8dab8d6be686ca9413e27a11e85f9cef1a |
com.notemaster.record.mark | 879168159c155758dbfd7a76e8f21548b6c5f7dfaf9d47cd67380a48df5e1731cb19dbf279a3488aec76c17e8e122c14fc812444baa071f5141ddad812d673ded6ba4044f9d57f7e86d83187982ed593 |
com.tst.blank | 4f7d3c5859100d65ff02449884841b9c50e9cdc3ed145bbc688356eda07f8eb39f1e2249003ab22cf8a38048e0ff6f6c |
com.yun.wth.er | e39bddf592016ad6d0784770df3e2ffe |
org.life.goal.tools | 7469c9c06e5f324ca608e0140156bbadda67e37be01c20566990152ecfb14ed1 |
picturetranslate.extractor.text.lite | 4521a5bbe0f33a15da86bd80ff5d6d9c8ec360829f4f7ae8dcae47c02b996762d56158a2cc8d13778df850907733b2c4836739fe7196437d8e998245b6f2b3b4 |
com.audify.editor.wavrge | fac6548a4a7a88156468b809c4f877f5 |
com.audify.editor.pro | cf4f24fdd283f80313565b08fea9d06d |
com.prorestore.qr | 3c098465af131141996ff840bd34e791 |
com.go.weather.mot | 387f7af167530486adcf3d8546063462 |
com.dmstudio.weather | ee4e778e53ce4d4339d7c7888d06384d |
Additional MD5 Hashes Published in the Analysis
| Associated package | MD5 |
|---|---|
picturetranslate.extractor.text.lite | e250e5966c119a9098f7818fc6c080e5 |
appicon.diy.tools.prop | 3b20edff1125e146aa3d5153708b58f4 |
com.dmstudio.weather | 542ab80429ec42e8643dc645f58b716c |
com.audify.editor.pro | 145b806282d247441751bb4957b71606 |
com.mb.applock.a02 | ee70ec99121f4d7c8b5a883e5ab3a858 |
com.solide.filemanager.lte | 92390cacdd20d2ee5405093669e7302c |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC
Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.