Bitdefender Finds Midnight Mimosa on Thousands of Android Phones in 150 Countries
Updated
Updated · Fox News · Oct 23
Bitdefender Finds Midnight Mimosa on Thousands of Android Phones in 150 Countries
1 articles · Updated · Fox News · Oct 23
Summary
Thousands of low-cost Android phones carried Midnight Mimosa in firmware before activation, giving the malware system-level privileges that survive normal app removal.
Bitdefender said the campaign ran for about two years across more than 150 countries, with the highest observed infections in Mexico, France and Italy, followed by the United States, Germany, Brazil and Spain.
The malware appears built mainly for profit: it silently installs and removes apps to commit ad fraud, and it can also disable Google Play temporarily to evade Play Protect during installation.
Bitdefender also found 13 related apps that had appeared on Google Play and identified code capable of turning infected phones into residential proxy nodes, though testing did not confirm active traffic relaying.
Affected devices were linked to some MediaTek-based multi-brand phones and counterfeit premium-looking models, but Bitdefender said the exact point of compromise in the supply chain remains unknown.