Kiran 
Bitdefender researchers have found a firmware-level Android malware campaign, which they call Midnight Mimosa. It runs on low-cost, multi-brand phones built on MediaTek platforms, and the owner cannot uninstall it.
The malware ships in the device firmware, so it is on the phone before the owner switches it on. It runs with system-level privileges, which let it silently install and remove apps, grant permissions and load code supplied remotely.
The main revenue streams are ad and click fraud, collection of device and app data, and turning phones into residential-proxy relay nodes in botnets.
Midnight Mimosa Malware Preinstalled
The first component identified was com.android.system.lite. Researchers later found the same core under other system-sounding names, including com.android.sys.prot, com.android.sys.gmsprot and com.android.sys.bcprot. Bitdefender stresses that the package name is not the threat, because the shared core underneath is
The enabler is platform-signed and runs as the system user. It holds privileged permissions such as INSTALL_PACKAGES, DELETE_PACKAGES and GRANT_RUNTIME_PERMISSIONS. Its app label is the generic “System”, and its icon is hidden.
The real logic sits in a native library, libeasy.so. At load time this library RC4-decrypts an embedded APK and drops it as a hidden framework. The framework fetches a remote configuration from a command-and-control server, then loads stage-2 and stage-3 DEX plugins.
Those plugins carry the monetization code: in-process ad fraud, and silent installation of partner apps.
The malware disables the Google Play Store just before installing a payload, probably to avoid Play Protect detection. It re-enables the store afterward, and again when the user is present, to avoid raising suspicion.
The system app does not register the fraudulent clicks itself. A rotating family of at least 32 disguised apps does that, including fake AppLock, weather, file-manager, OCR and audio-editor apps. They load genuine ads through a legitimate ad SDK and place an invisible window on top.
The ad-fraud plugin is driven by remote settings. These control what share of ads receive a “silent” click with no user touch and where on the ad the synthetic touch lands. The ad surface is also flagged as secure, so it does not appear in screenshots or screen recordings.
The payloads are installed and removed repeatedly on the same devices. This shortens the time each one is visible, rotates file hashes and lets operators swap monetization modules while the system component stays in place.
The enabler also enables Accessibility and Notification Access on its own. It declares SMS permissions too. Researchers did not see these used, but they are available to operators on demand.
Accessibility access is the standard mechanism behind Android banking trojans, and SMS access can expose one-time codes. Bitdefender also found 13 apps on Google Play that talk to the same servers, under at least two developer accounts.
Attribution is unclear. Firmware on affected devices was signed with certificates bearing the name Shenzhen Zediel. Bitdefender cannot say how those certificates got onto the phones or whether their owner knew. Other phones without Zediel-signed firmware carry the same malware, and the point in the supply chain where it is added is unknown.
Mitigation
Bitdefender links the problem to very cheap and sometimes counterfeit Android phones, such as knock-off “S24 Ultra” and “S25 Ultra” models. It says such devices may be loaded with software that earns money after the sale.
- Buy from reputable retailers and brands.
- Be suspicious of flagship-priced features at budget prices.
- Check for hidden “System” packages and unexplained app installs.
- Use behavior-based mobile security tools, since store scans cannot see firmware-level threats.
The article is about 550 words. I left the quote slot as a placeholder because I can’t invent a quote and attribute it to a real person. I can write an opinion paragraph in your editorial voice if you’d prefer.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
1 thought on “Midnight Mimosa Malware Preinstalled on Budget Android Phones Turns Devices Into Botnets”