Bitdefender researchers have discovered Midnight Mimosa malware preinstalled in the firmware of thousands of budget Android smartphones, primarily those powered by MediaTek processors. Over the past two years, infected devices have been identified in more than 150 countries. The program allows attackers to silently install apps, inflate ad impressions and clicks, and use smartphones as residential proxies.
How Midnight Mimosa Works
Midnight Mimosa is embedded in Android firmware and has system privileges that allow it to install apps without user involvement. The com.android.system.lite component handles this, while the main malicious code is located in the libeasy.so library. Additional modules can be downloaded and managed remotely.
To bypass Google Play Protect checks, the malware temporarily disables Google Play Store before installing additional apps, then turns it back on.
At least 32 apps installed this way were discovered, disguised as regular utilities such as weather forecasts, file managers, etc.
How Ad Inflation Works
Midnight Mimosa is used to inflate ads through apps with legitimate ad SDKs. These apps loaded ads from ad networks, including in hidden windows, while the malware automatically simulated clicks without the smartphone owner’s involvement.
The com.wz.sdk module handles the inflation. It can simulate clicks through the performClick() method, configure click probability, intervals between clicks, and daily limits. It can also automatically send conversion events 60 seconds after an ad impression.
All parameters are configured remotely, allowing attackers to adjust the intensity of the fraud. As a result, ad networks recorded this activity as regular impressions and clicks. This allows attackers to profit from advertisers that pay for such traffic.
Thousands of Infected Devices in More Than 150 Countries
According to Bitdefender, the malware was discovered on thousands of devices in more than 150 countries over roughly two years.
The largest number of infected devices was recorded in Mexico, France, and Italy. They are followed by the US, Germany, Brazil, and Spain.
Models include the Doogee S200 X, Cubot KINGKONG X, as well as cheap counterfeits of flagship Samsung smartphones and iPhones. However, this involves individual infected devices, not all smartphones of the listed models.
In addition, researchers found 13 apps on Google Play with similar ad inflation code. They interacted with the same infrastructure as the malware embedded in smartphone firmware.
Unlike the preinstalled software, these apps did not have system privileges, but they could also display ads outside their own windows, including when the user was not interacting with the smartphone.
Smartphones Could Also Be Used as Residential Proxies
In addition to ad inflation, Midnight Mimosa contains a module that can turn infected smartphones into residential proxies and connect them to botnets.
This means fraudsters could potentially use the smartphone owner’s internet connection to route third-party traffic.
However, during testing, researchers were unable to confirm the actual transfer of traffic through the proxy, although the traffic routing mechanism itself is present in the code.
You cannot remove the malware through ordinary means because it is embedded directly in the device’s system firmware. Even a factory reset does not solve the problem. To remove it, you need to wipe the firmware or disable the malicious component using specialized tools.
It is still unknown who exactly implanted the malware. According to the researchers, this could have happened at different stages of smartphone manufacturing or distribution.
Comments