Midnight Mimosa Infects Android Phones Before Users Even Turn Them On

Midnight Mimosa is reaching Android phones before their owners even press the power button. The malware arrives inside device firmware, giving its operators a hidden foothold that does not depend on a malicious download, a phishing link, or someone accepting an app permission request.

The campaign affects low-cost Android devices from several brands built on MediaTek platforms. Its main purpose appears to be making money through fake advertising activity and residential proxy services, while its system access also allows operators to install apps, remove them, and load new code without asking users.

Researchers from Bitdefender identified Midnight Mimosa after their App Anomaly Detection technology flagged a system package behaving unlike a normal Android component.

The detailed malware research report by Bitdefender, published October 8 and updated October 9, describes thousands of affected devices across more than 150 countries during a roughly two-year observation window.

Mexico, France, and Italy led the observed distribution, followed by the United States, Germany, Brazil, and Spain. These findings reflect Bitdefender’s visibility, not a complete global infection count.

Some phones also reported counterfeit flagship names, meaning their model labels cannot reliably identify the hardware or its actual manufacturer.

Midnight Mimosa Infects Android Phones

The investigation started with a hidden component labelled “System.” Signed with a platform certificate and running under Android’s system user, it could install packages and grant permissions silently.

Unlike an ordinary downloaded app, this firmware component could not be removed through the phone’s normal uninstall controls. This delivery method puts the problem inside the device supply chain rather than placing responsibility on the owner.

Earlier cases involving preinstalled Android firmware malware show why reviewing downloaded apps alone cannot protect a phone that already contains a trusted but harmful system component when it leaves the seller.

The malware hides much of its code in a native library. During startup, that library decrypts an embedded APK using RC4 and loads a hidden Java framework.

The framework then downloads further DEX and JAR modules, allowing the operators to change the phone’s behavior after purchase. Those modules handle fake ad clicks, app installation, and additional downloads.

Some JAR files are stored with an object-file extension, while downloadable modules are served as PNG files. These layers make the original APK a poor guide to what the malware will eventually do on a working device.

Hidden Ads and Proxy Traffic

Bitdefender found at least 32 disguised apps in the wider operation, including weather tools, app locks, file managers, and text scanners.

The system component repeatedly installs and removes these payloads. That rotation changes the visible app inventory while leaving the main firmware infection in place.

Advertising revenue comes through ordinary-looking cover apps carrying a legitimate advertising SDK. Hidden activity creates impressions and clicks without real user input, with timing limits intended to make traffic look natural.

The related Android Phantom click fraud research offers useful background on similar tools and infrastructure identified in this investigation.

A separate fake app-lock payload can enroll the phone as a residential proxy, letting a remote operator route traffic through its connection.

Earlier research into BADBOX Android proxy malware illustrates the wider risk of consumer devices becoming network relays. However, Bitdefender did not observe traffic being relayed during its fresh-node test.

Before installing payloads, the malware disables the Google Play Store package, apparently to avoid detection by Play Protect, and then enables it again.

It also restores the store when the user is present. Some samples falsely record Google Play as their installer, despite lacking Google’s distribution signature block.

Researchers also found the same ad-fraud code in 13 Google Play apps. Those store builds lacked the system powers of the preinstalled malware but still displayed ads outside their normal interface.

Previous reporting on Google Play advertising fraud shows why official distribution alone does not guarantee harmless behavior. The system component requests sensitive access involving Accessibility, notifications, and SMS.

Researchers observed repeated enabling and disabling of Accessibility and Notification Access, but did not see those capabilities used for theft. Their presence, combined with remote code loading, leaves room for operators to expand the campaign beyond advertising fraud.

Some affected firmware used certificates bearing Shenzhen Zediel’s name, but Bitdefender did not establish that the company created, approved, or knowingly distributed the malware.

The point where it entered the supply chain remains unknown. Durable cleanup requires firmware-level work; normal uninstall methods cannot remove the root component.

Vendors and sellers therefore hold a central role in fixing affected devices. Crucially, the report corrects one network finding: an address first described as a proxy command server was actually a sinkhole, not confirmed attacker infrastructure.

Indicators of compromise (IoCs)

Network, File, and Detection Indicators

Type	Indicator	Context
Control endpoint	api.weatherlive[.]world/br_upgrade/upgradeV2/getConfigs	Encrypted module configuration and control channel.
Telemetry endpoint	api.weatherlive[.]world/odborwer_dot/cm	Device telemetry and fabricated advertising events.
Download host	oss.showtimetool[.]com	Module and asset delivery; payloads served with .png extensions.
Reporting endpoint	39.96.8.180:9008/ssc/rprt/bug	DX/S1 framework bug-report endpoint.
Reporting endpoint	120.78.215.151:80/api/bugLog	Embedded-framework crash-report endpoint.
Proxy host pattern	{productId}.apple.<domain>:6000	Proxyware control-host construction.
Proxy domain	0aa0cf0637d66c0d[.]com	Domain in the proxyware host rotation.
Proxy domain	aa86a52a98162b7d[.]com	Domain in the proxyware host rotation.
Proxy domain	442fe7151fb1e9b5[.]com	Domain in the proxyware host rotation.
Proxy domain	v46wd6uramzkmeeo[.]in	Domain in the proxyware host rotation.
Related infrastructure	cgb.jingongbuxiao[.]com	Shared indicator cited in the Android.Phantom operator-lineage analysis.
Related endpoint	5.ahd187[.]com/thirdsdk/flowcashpack/	Shared Android.Phantom-related download infrastructure.
Historical related domain	zhuifengzhe[.]top	Infrastructure connecting earlier Joker and Phantom research.
Related host	fyapi.freeflightbird[.]com	Host listed in the Phantom/Click lineage.
Related host	newsadapi.zhuifengzhe[.]top	Host listed in the Phantom/Click lineage.
Native library	libeasy.so	Native core that decrypts and drops the hidden framework.
Native-library MD5	a8847b68428fde206b6dff8001051f92	MD5 published for libeasy.so.
Renamed native library	libunionprt.so	Native core name used by a confirmed variant.
Framework namespace	cn.kw.lib.hex	Hidden framework dropped by the native core.
Loader/files	cn.kw.lib.dx.DxFactory; kwlib.jar; kwlib.next	Remote framework loading and update artifacts.
Plugin files	files/plg/<md5-id>/magic.o; magic.o.info	JAR plugin and its descriptor; angle-bracket value is variable.
Bundled payload	assets/mediaapp-release.apk	Partner APK embedded inside stage-three plugins.
Plugin classes	com.wz.sdk.DxFactory; com.earnsdk.lib.DxFactory; com.gogo.third.lib.DxFactory	Ad-fraud and silent-install modules.
Payload markers	EnLoaderLib v1.0.6; com.ctr.cbd	Proxyware loader and separate ad-fraud module.
Service marker	com.media.am.intent.action.BIND_SERVICE; MyDataService	Communication between cover apps in the advertising mesh.
Install-source marker	Installer recorded as com.android.vending, without Play “frosting”	Forged Google Play provenance in identified samples.
Device-context marker	Wi-Fi MAC prefix A0:53:94	Zediel-associated allocation; not proof of infection by itself.
Partial certificate marker	0105bc4c…	Published platform-certificate prefix, not a complete hash or proof of company involvement.
String cipher	AES-128-CFB; key derived with MD5("aGV4QCFRQFcjRQ=="); IV 0102030405060708	Hidden-framework string encryption.
String cipher	AES-128-CFB; key derived with MD5("dHhAZXhAc2Vy")	Enabler string encryption.
String cipher	AES/CFB; key derived with MD5("ZHhAIVFAVyNF")	Stage-three plugin string encryption.

Corrected Infrastructure Finding

Indicator	Corrected status	Handling note
85.17.70.38:6000	Sinkhole	Bitdefender initially described this address as live proxyware C2, then corrected that finding. Do not label it confirmed attacker-controlled infrastructure.

Complete Published Sample Set: 120 MD5 Hashes

Android package	Published MD5 hashes
com.android.browser	05ae89e761a890fa24f80f4be7263651 1da42505f1c83959c7f901f5139a158e a147cd8f72aadfcf78f7723db6813e86 f456f0c6b89bd3d5124699d43971d094
com.android.deskclock	2c77653b889dfccd649b82446f8c0d1b 5d29e9b24708c3ec36d1d59036124838 998e9010e5dfc4e4645f5572cbbe5b53 b3a4405d1b8d43545d07b10581008d32
com.android.gallery3d	0377ca97ac0ca35f9134052fede67a81 0b0d8e995e6ff24d4e9d00417446c25e 1414d4ef2d1191080abc59a407dcb6c5 345057421c7d9ac2b671c47449f35030 36deebfcda4012d18706cd170c1edf1f 37f18a20b9cf32e6f07450e903eaad7c 4507363415e7dc6d2cab14eeed137f6c 512a6db4a22244272826f39da020fb44 5b3a49938f455d1197736971c4c07228 6aca76699ec0bb8e51372d5c68c8359b 815b910f1efc95f38ba0c5b12c4f2129 c75ec7f3bcbc879aae9a21ad544d3232 d9fc6b2cd5eaa3929207f1029663d947 e51c11442a529dcd06dc7c8e45974ec2 e9b91e1d94bb3ff9a1c00b1c13eb7960
com.android.settings	be22c91b4578ac2357a16133615df335
com.android.sys.bcprot	d5d88214170875386ab855172f881e51 dce5b0dc0e7d7059b5ab8384a7c24ec4
com.android.sys.dts	61aac6a98abd6dcff0dc41bb88159786
com.android.sys.gmsprot	2b784622422f4280e0b3e38b30dd87bc
com.android.sys.prot	2b7f1a7d5f5515c05d0c8e3857155ae2 3d3358b1057b1bfbd7e60577d8a31e0c 7400c34f7c6f866499029f5e759f58bd d4ceb05682ecd60f4ebb4e76e02fcf7d
com.android.system.lite	60bc23d3d453f258e2c4ca421cd086a9 b862681953e945439167a736ba4cd41b
com.android.weapps	ed1a6bed83899952b464c27aef9752cc
com.android.weiapps	0903d7fd3e1d4a599a7eb3c5d356779b
com.mb.applock.a02	a57a1ba15364dfb35d334f644d7049e8
com.mb.applock.ea	cde0490e11db8ad54737c1df59ec658b
com.mobile.applock.en	08d231c6a5303e543eb60d4181f6a4ea 7f7747575980098bdc98e7b7aa362697 d3faec4f013c4a1e84a1d681448312c0
com.mobile.applock.tg	e75e183027bf897eda6447366c7acd01
com.mobile.applock.wg	20108557cacd24263e7e611afc327801 aac942aaf6ec0773cbac87fde4a6b284 cf20de9d9ddc952bb2265002d26a916f f602230f54507cbddf5ef3014737d768
com.mobile.applock.wt	079298a7a506b376def4f4ff9a250672 20cefb2c667f945d482daded7e698eea 254bc5f6f81de1f3c47534e6febaf023 31b3280f1c0836c39c470932cf6c3e6f 3b35d3c5667136134b20a8411803c97d 3bc159537c909fa86bcc55eda127b5aa 42a9f64e75911c167ec7a163e8b24920 4a171f62d1bab01827b06ae73d4caafa 66c6512b9a73425aba40c8bfa95d23a0 6df909898f5f1394e78508d1152fab38 6ee2be3e5558085b532dacc8db61f3e9 6eea0568d5cc776ae03e09149cec3cd8 765d3ce85a6393d05973c4cfa7738116 90e0d27d808105167fdaa3a22b918217 9e7b34e63d8d38e37667f88a945ae69a a02f28387527abe90d73d2879f671972 abe12db77a62ecb99d6ab5dc4fff18c7 de66cac88f156c3227749e03bdf7cf54 e6650dc6721aaa27f8a289ff92e613ff e7c56b4f580da53cd0e4f11d1a11e402
com.mobile.applock.xk1	2de346602433cdd1668f36b2e9db0be1
appicon.diy.tools.prop	af16072864ae0f9d755f8cf00fded359 e974cf4cc5d55cddc04f026dd3ea72b8 ac8957a474f8aa812c7b233aafde4723
com.android.non.szcz	250205ee4b8de59e60c745856f439608
com.arabmusic.tap.aghani_tamerhosny	af7f1eef22bf5ee3d0a394f53ba7e1b8 838dc8fcde1b28171e404ece1cfcde44
com.awht.zfip.zfyg	7322d8a65a56a7ab09f4d526cb343e3d
com.cool.weather.yl	0b8d3cd264c191f4884a25d0cc5318b5 33b2d3ec9a35cfb0b5a5d7b24ce4140e 3bb270d4927e2a8385793d9084a92fd3 4e46549122c0236307c5eef8891466f5 642d84ed5660407b972f1df642acb192 9a3d04aa36654b5c4b21edd22e46f92d b7d0d5ae09b0d2d2f999c1087c450456 cdfcc848e16660d607aba6ecf24567f4 f0b7b1c940ebcee97eb68f528682fc50
com.dl.guard.lock	1150da1af88729e54a34b8da5a2741c7 36f9e8cf47a28f9803fba427cf02a25c 6739fe083cfa8dec9b4f989ccba0e99e ca7e2d265fc35aede432c4636a2cf4cb fcb9f38cc687fc8a4637e0acdf91ab66 c8ea2a7c1f52c4c2474475c28373ee27
com.energy.appstore	c55c9d7e12cc273b812ceffca8f62d4b
com.fb.w.weather	9a46098de785ae732e5fced55a2f3063 d145b14b9cc15799485f2592b2c16d9a
com.fe2bu1.wh	0a26a9d5f7ab91cb5eed852cf83ef078 294ab3f586d76772ae89add417cf6324 a13af0174bc211709e8b73bf60492a17 b974ef4106af6b932df352563a9b8b3c e9ec6d7b50c1e54cd523283b9de55e10
com.message.recovery.prorestore	5400ffac371c5e5c9b7f3705ce9faca5 92f2fd8bcccc8ec4ffa64c7f6b3b9b8d ab8d6be686ca9413e27a11e85f9cef1a
com.notemaster.record.mark	879168159c155758dbfd7a76e8f21548 b6c5f7dfaf9d47cd67380a48df5e1731 cb19dbf279a3488aec76c17e8e122c14 fc812444baa071f5141ddad812d673de d6ba4044f9d57f7e86d83187982ed593
com.tst.blank	4f7d3c5859100d65ff02449884841b9c 50e9cdc3ed145bbc688356eda07f8eb3 9f1e2249003ab22cf8a38048e0ff6f6c
com.yun.wth.er	e39bddf592016ad6d0784770df3e2ffe
org.life.goal.tools	7469c9c06e5f324ca608e0140156bbad da67e37be01c20566990152ecfb14ed1
picturetranslate.extractor.text.lite	4521a5bbe0f33a15da86bd80ff5d6d9c 8ec360829f4f7ae8dcae47c02b996762 d56158a2cc8d13778df850907733b2c4 836739fe7196437d8e998245b6f2b3b4
com.audify.editor.wavrge	fac6548a4a7a88156468b809c4f877f5
com.audify.editor.pro	cf4f24fdd283f80313565b08fea9d06d
com.prorestore.qr	3c098465af131141996ff840bd34e791
com.go.weather.mot	387f7af167530486adcf3d8546063462
com.dmstudio.weather	ee4e778e53ce4d4339d7c7888d06384d

Additional MD5 Hashes Published in the Analysis

Associated package	MD5
picturetranslate.extractor.text.lite	e250e5966c119a9098f7818fc6c080e5
appicon.diy.tools.prop	3b20edff1125e146aa3d5153708b58f4
com.dmstudio.weather	542ab80429ec42e8643dc645f58b716c
com.audify.editor.pro	145b806282d247441751bb4957b71606
com.mb.applock.a02	ee70ec99121f4d7c8b5a883e5ab3a858
com.solide.filemanager.lte	92390cacdd20d2ee5405093669e7302c

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Midnight Mimosa Infects Android Phones Before Users Even Turn Them On appeared first on Cyber Security News.