Researchers at Bitdefender have discovered a malware campaign, identified as Midnight Mimosa, in which malware is embedded within the firmware of low-cost Android phones. Affecting thousands of devices across more than 150 countries, this campaign is notable in how it grants the attacker system-level privileges and contains no uninstall option. Every user-facing defense against malware is bypassed before the phone is even powered on for the first time.
A System App Disguising the Threat
The first note of suspicion came when Bitdefender’s behavioral detection flagged the system app com.android.system.lite, which doesn’t register the fraudulent activity being carried out. The app is platform-signed and labeled “System” and has no icon. It repeatedly grants itself Accessibility and Notification Access and SMS read/write permissions, which each enable attackers' extreme levels of privilege on the target system.
The persistent system application deploys a rotation of at least 32 disguised apps, including a fake AppLock tool that does not contain AppLock functionality. Instead, this application leads back to the preinstalled root.
Inside the Enabler
The preinstalled system application contains a thin Android Package Kit (APK) shell that covers an encrypted native library. The hidden framework fetches plugins from a command-and-control (C2) server that poses as a weather API. It carries out a series of silent installs, permission grants, and remote code loading on the target device with the same core of disguised applications under rotating package names designed to sound system-related.
Blinding Remaining Defenses
This malware campaign employs a variety of tactics to evade detection. It disables the Google Play Store app just before each payload is installed, then re-enables it when installation is complete, likely to prevent being caught by Google Play Protect. A safety net built in also prevents user suspicion by enabling the app when the target is present.
The installer field on the malware payload is spoofed to show the source as Google Play, in an attempt to fake legitimacy. However, the missing Play signature block exposes it as a forgery. Payloads are installed and removed from the device repeatedly in order to limit user visibility into the mechanisms of the malware attack.
How the Operation Makes Money
Bitdefender’s researchers surmise that the campaign’s aim is probably the generation of revenue, achieved through a range of means. Cover apps with legitimate advertisement software development kits (SDKs) are able to collect revenue for the attackers. The campaign also involves click fraud, with synthetic clicks paced by daily caps and intervals to look organic.
The ad surfaces involved in the attack are marked as secure and hidden from screenshots and screen recordings. The target devices are also enrolled as residential-proxy relay nodes, allowing the attackers to monetize the user’s connectivity.
Untapped Capabilities
While the malicious activity seen in the campaign is extensive, an equally alarming factor is the amount of capability that the attackers hold that hasn’t been seen in use yet. The Accessibility and Notification Access and SMS read/write permissions have not been observed in use yet, demonstrating the significant amount of power these attackers could exercise if and when they choose to take advantage of it. These are the same mechanisms that are often behind banking trojans and one-time-code theft.
Activation and use of these capabilities come down to a decision made by the malware operator at the C2, rather than something inherent in the technology or tactics. This malware campaign contains infrastructural links to 2021’s Joker premium-SMS fraud and 2025’s Android.Phantom click fraud campaign. Bitdefender’s analysis places all of these campaigns in a multi-year malware operator lineage.
A Supply Chain Without a Clear Culprit
This campaign features firmware signed with certificates bearing the name Shenzhen Zediel, delivering malicious applications with the addition of residential proxyware. There is no proof of how these certificates made it onto the targeted devices, nor evidence of the participation of the certificate holder in the attacks.
The operators of these attacks are not constrained to just the Zediel-signed firmware on cheap Android phones. They use low-cost—and sometimes counterfeit—iPhone and Galaxy models as well, alongside Doogee and Cubot devices. The campaign having two regional centers in Western Europe and the Americas points to online marketplace distribution of these devices.
The confusion around Midnight Mimosa operators and distributors is exacerbated by ineffective supply chain management on the part of manufacturers. “One of the biggest blind spots is the lack of oversight into third-party firmware, preinstalled applications, and software components supplied by outside vendors,” says Roland Lindsey, Lead Solutions Engineer at Finite State. “Manufacturers need to take responsibility for the entire software supply chain, not just the components they develop themselves.”
The Same Code Inside Google Play
Bitdefender’s researchers also uncovered thirteen apps on Google Play that carry the same ad-fraud markers, like communication with the servers that control the malware. These apps lack the excessive permissions that would enable them to carry out the same damage as the malware attack, but the presence of these markers is notable regardless.
The campaign uses rotating signing identities, with thirteen packages each carrying a different signing certificate, across at least two developer accounts. Genuine Play builds that contain the Play signature block missing in the fraudulent builds are able to pass review without the use of counterfeit hardware. Removing either channel for the dissemination of this malware still leaves the other channel intact, enabling further malicious activity.
A Fix Owners Cannot Apply
This campaign presents a threat that device owners cannot easily fix on their own. Removal of the malware requires firmware cleanup or use of Android Debug Bridge. Package-name blocklists age out immediately due to rotating package names. Detection is keyed to the shared core and C2 under the malware operator’s control. A durable fix for this threat rests on vendors and marketplaces to figure out.
