Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries

What it is

Midnight Mimosa, a firmware-level malware campaign on budget MediaTek-based Android devices, analyzed by Bitdefender over the past two years. The malicious system app is preinstalled before sale and cannot be removed through normal uninstall procedures.

How it works

The malware ships as a persistent firmware system app running with system-level privileges. This lets it silently install and remove apps, grant permissions, and load arbitrary code supplied remotely from a C2 server — effectively letting operators retune any infected device on demand or fold it into a botnet. On the Google Play side, the same ad-fraud code family (found in 13 apps across two developer accounts with separate signing certificates) uses plugins that disable Google Play Protect for the duration of a malicious install, then re-enable it afterward — Bitdefender notes the install happens "in a window where Google's scanner is switched off."

flowchart TD
    A[Device sold with firmware malware] --> B[Boots with hidden system app]
    C[Google Play app, separate dev account] --> D[Disables Play Protect]
    D --> E[Installs ad-fraud payload]
    E --> F[Re-enables Play Protect]
    B --> G[C2-controlled: install/remove apps, load code]
    F --> G
    G --> H[Ad fraud, click fraud, botnet/proxy abuse]

Preconditions / Affected

Budget MediaTek-based Android devices with the firmware app preinstalled at manufacture; no uninstall path exists for affected units. Distribution spans 150+ countries over two years, with Mexico and France leading, followed by Italy, US, Germany, Brazil and Spain — Western Europe and the Americas stand out, with no single dominant region. Google Play exposure applies to users of any of the 13 identified apps, which run without the privileged firmware access but share the ad-fraud code family.

What to do

The page states Bitdefender's report includes "an extensive list of IoCs to help prevent it," but the article itself does not reproduce specific indicators, app names, or hashes — only that they exist in the underlying report.

Caveats

The article gives no monetary-impact figures for the operators and does not name the 13 Google Play apps or list specific IoCs; those details would require pulling Bitdefender's original report.