Midnight Mimosa malware ships in Android firmware before the phone's first boot

Malware shipped inside the factory image

Bitdefender Labs has documented an Android threat it calls Midnight Mimosa, and its defining trait is where it lives: inside the firmware of budget MediaTek-based devices, present before the phone ever reaches a customer. A summary of the research published on dev.to, which cites BleepingComputer as related coverage, describes the implant as a system application signed with the platform certificate — the level of trust Android reserves for the operating system itself.

That positioning matters. Because the app is platform-signed, it arrives with powerful entitlements such as INSTALL_PACKAGES and GRANT_RUNTIME_PERMISSIONS, and standard uninstall options do not touch it. According to the report, even a factory reset is unlikely to help, since the enabler sits in the system partition rather than user storage. It has no launcher icon and presents itself as a system component, so there is very little for an ordinary user to notice.

How the chain unfolds

After the device first boots, a native library identified as libeasy.so decrypts and loads a framework embedded alongside it. That framework contacts a command-and-control endpoint disguised as a weather API, retrieves remote configuration, and fetches additional code modules from a separate hosting server.

With the Google Play Store temporarily switched off, the enabler silently installs a disguised payload application and grants it dangerous permissions without any user interaction. Bitdefender's telemetry on real devices showed the enabler installing and removing at least 32 distinct disguised apps, with payloads rotated often enough that file hashes and visual details keep changing — a deliberate frustration of blocklists.

The report is candid about what remains unknown: the point in the supply chain where the firmware was tampered with, and which entities were involved, have not been established.

Ad fraud and proxy enrollment

The payloads monetize infected handsets in two ways. One variant is a cover app resembling a weather utility or an AppLock tool that performs hidden advertising and click fraud. The other has no icon at all and registers the device with a residential proxy service through a TCP back-connect connection on port 6000, effectively offering the phone's bandwidth and home IP address to third parties.

Bitdefender verified the ad-fraud and proxy capabilities through sample analysis, and its dynamic testing confirmed both the command-and-control connection and proxy node registration. It did not observe actual traffic being relayed, because the freshly registered node was never handed any relay targets — a nuance the report stresses, warning analysts not to treat registration activity alone as proof that traffic was relayed. The enabler can also grant itself Accessibility, Notification Access and SMS permissions, although no abuse of those capabilities was observed in the samples studied.

Detection and remediation

Indicators for investigators include permission changes made by system apps, the Play Store being disabled, silent package installations, and traffic to domains such as api.weatherlive[.]world and oss.showtimetool[.]com. A package named com.android.system.lite, the libeasy.so library, and connections on TCP/6000 are called out as hunt targets across MDM, DNS and mobile telemetry.

Remediation is blunt. If the vendor ships a firmware update that verifiably removes the malware, that may suffice; otherwise the report recommends replacing the hardware outright. MDM controls, egress filtering and trusted procurement are flagged as the practical defenses, since user-space antivirus tools cannot see a threat rooted in the system image, and Secure Boot or attestation checks do not guarantee a signed image is clean.

Why it matters

Midnight Mimosa inverts a basic assumption in mobile security: that a new, unopened device is a clean baseline. The compromise precedes first boot, survives resets, and carries operating-system-level privileges, which means conventional endpoint defenses and user vigilance are largely irrelevant. Beyond the direct cost of ad fraud, residential proxying routes strangers' traffic through victims' connections, with potential legal and reputational fallout for the device owner. For organizations deploying fleets of low-cost Android hardware, the case is a strong argument for verified procurement channels, firmware attestation and network-level monitoring rather than trust in the sealed box.