Bitdefender Uncovers Midnight Mimosa Rootkit Silently Installing Apps on MediaTek Phones Before Power-On

Bitdefender researchers discovered that the Midnight Mimosa malware campaign targets low-cost Android devices built on MediaTek platforms. This threat inserts itself into the device firmware, allowing operators to manipulate the phone before the owner ever presses the power button.

What happened

Bitdefender’s App Anomaly Detection technology flagged a system package that behaved differently from standard Android components. The resulting investigation, detailed in a report published on October 8 and updated on October 9, uncovered a widespread infection. The malware arrives inside the device firmware rather than through a user download. This delivery method provides operators with a hidden foothold that ignores typical security prompts.

The campaign affects devices from several brands using MediaTek hardware. Researchers observed thousands of affected devices across more than 150 countries during a two-year window. Distribution was highest in Mexico, France, and Italy, followed by the United States, Germany, Brazil, and Spain. These numbers reflect Bitdefender’s specific visibility rather than a total global count. Some infected phones displayed counterfeit flagship model names, making it difficult to identify the actual hardware manufacturer.

The core of the threat is a hidden component labeled “System.” It runs under Android’s system user and is signed with a platform certificate. This signature allows it to install packages and grant permissions silently. Because it is part of the firmware, users cannot remove it through standard uninstall controls. The code hides in a native library that decrypts an embedded APK using RC4 during startup. This process loads a hidden Java framework that downloads additional DEX and JAR modules.

Why it matters

The primary goal of the Midnight Mimosa campaign appears to be generating revenue through fake advertising activity. The malware also facilitates residential proxy services. However, the system-level access allows operators to install apps, remove existing ones, and load new code without asking for permission. This bypasses the need for phishing links or malicious downloads.

The supply chain nature of this threat means the problem exists before the phone reaches the consumer. Earlier cases of preinstalled firmware malware show that reviewing downloaded apps is insufficient. A phone can contain a trusted but harmful system component when it leaves the seller. Standard security measures that focus on user behavior cannot detect a component that is already part of the operating system.

Some downloadable modules are served as PNG files, while other JAR files use object-file extensions. This obfuscation makes detection harder for casual users. The ability to change phone behavior after purchase creates a persistent risk for device owners. Operators can alter the device’s function remotely via the downloaded modules.

Our take on the response

The findings highlight a critical gap in consumer security awareness. Users often assume that avoiding suspicious links protects their devices. This campaign proves that firmware-level threats require different detection methods. Bitdefender’s use of anomaly detection was key to identifying the unusual system package behavior.

The presence of counterfeit model labels adds another layer of complexity. Buyers cannot rely on device names to verify hardware origins. This suggests that supply chain verification is essential for manufacturers. Without strict oversight, low-cost devices may carry hidden risks. The reliance on platform certificates by the malware underscores the need for rigorous signing practices.

What to do and how to stay safe: Midnight Mimosa

• Verify the manufacturer and model details through official channels before purchasing low-cost Android devices.
• Monitor for unexpected app installations or removals that you did not initiate manually.
• Use security software capable of detecting anomalies in system-level components rather than just scanning installed apps.
• Check for firmware updates from the device manufacturer once they become available to address known vulnerabilities.

Step-by-step guide: Multi-Factor Authentication Best Practices for Secure Access

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is Midnight Mimosa?

Midnight Mimosa is a firmware malware campaign that infects low-cost Android devices built on MediaTek platforms before users power them on.

How does the malware persist on the device?

It resides in the firmware as a hidden system component signed with a platform certificate, making it unremovable through standard uninstall controls.

Which countries have the highest distribution of infected devices?

According to Bitdefender’s observations, Mexico, France, and Italy led in distribution, followed by the United States, Germany, Brazil, and Spain.