Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Preinstalled Midnight Mimosa malware hits low-cost Android phones

2 sources · 2 articlesFirst reported Updated ()1 · 1 read
What's new

October 20: Reports say proxy traffic was not observed, an initial control endpoint later became a sinkhole, and the enabler briefly disables the Play Store.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Midnight Mimosa ships in cheap Android firmware, running ad fraud on thousands of phones; live proxy use was not observed.

Bitdefender, with PolySwarm cited by Cyber Security News, describes Midnight Mimosa as malware preinstalled in low-cost Android firmware, including MediaTek-based phones and counterfeit flagships. A platform-signed system app, com.android.system.lite, can install or remove apps, load remote DEX or JAR plugins, and briefly disable the Google Play Store before adding payloads. One package, com.mobile.applock.en, includes EnLoaderLib proxyware, but researchers did not capture live proxy traffic or permission abuse, and an initial control endpoint was later a sinkhole. Thousands of devices in more than 150 countries were seen over about two years. Removing visible apps can leave the firmware enabler able to reinstall payloads, and the supply-chain entry point was not identified.

Key facts
  • Highest counts were Mexico, France and Italy, then the US, Germany, Brazil and Spain.
  • Researchers found at least 32 disguised apps and 13 related Google Play ad-fraud apps.
  • Named packages include com.android.system.lite and com.mobile.applock.en.
  • A Shenzhen Zediel certificate identifier does not prove where firmware was compromised.
  • Overlaps with Joker, Phantom, Click and BADBOX 2.0 do not establish shared ownership.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • GBHackersMediaTek and counterfeit devices, EnLoaderLib, certificate caveat, and family overlaps.
  • Cyber Security NewsPolySwarm citation, fuller country ranking, and no observed permission abuse.
Vendors
MediaTekGoogle
Products
AndroidGoogle Play
Malware
Midnight MimosaEnLoaderLibcom.android.system.lite
Organizations
BitdefenderPolySwarm
Countries
MexicoFranceItalyUnited StatesGermanyBrazilSpain

Coverage

oldest first · one row per article · UTC
  1. · 5d ago GBHackersFirst report

    Midnight Mimosa hides ad-fraud malware in cheap Android firmware

    Bitdefender saw thousands of infected phones in more than 150 countries over about two years.

  2. · 5d ago Cyber Security News

    Midnight Mimosa malware ships in Android phone firmware

    A platform-signed system app installs ad-fraud plugins after briefly disabling the Play Store; proxy use was not seen.