Overview
- Bitdefender published its analysis on Thursday showing a campaign called Midnight Mimosa is embedded in firmware on low-cost Android phones built on MediaTek chipsets.
- The malicious components run as signed system apps that start at first boot and can silently install or remove apps, grant permissions, and load code from remote servers.
- Researchers traced the operation to thousands of devices in more than 150 countries over about two years and found the campaign uses cover apps to generate ad and click fraud.
- Investigators linked 13 Google Play apps to the same command-and-control infrastructure and found the malware temporarily disables the Play Store and alters installer records to evade Play Protect.
- Removing the infection is difficult for users because it lives in protected firmware partitions so fixes require trusted firmware replacement, official vendor updates, or device replacement and the supply‑chain entry point remains unknown.