Bitdefender: Midnight Mimosa Botnet Embeds in Cheap Android Firmware Across 150 Nations

Bitdefender researchers have identified a widespread malware campaign named Midnight Mimosa that targets low-cost Android smartphones manufactured with MediaTek platforms. According to a report by Security Affairs, this malware is preinstalled directly into the device firmware, meaning it arrives on the phone before the user ever powers it on. The campaign has been observed in 150 countries, indicating a massive global distribution of infected hardware.

In plain English

The Midnight Mimosa malware operates as a persistent botnet that exploits the lowest level of the phone’s software. Because the malicious code is embedded in the firmware, standard uninstall procedures do not work. Users cannot remove the threat by deleting apps or resetting settings in the usual way. The malware functions in the background without obvious signs of infection to the average user.

The background

According to Security Affairs, Bitdefender’s analysis revealed that the malware performs several harmful actions once the device is active. It generates fake advertisement clicks, which can distort advertising metrics and generate illicit revenue for the threat actors. The malware also drops additional applications onto the infected devices, expanding its functionality and footprint. Furthermore, it builds a proxy botnet, allowing attackers to route their traffic through the compromised phones to hide their true location.

What changes now

The discovery highlights a significant supply-chain risk in the market for budget-friendly smartphones. Security teams must now consider that hardware from certain manufacturers may arrive with embedded threats. The inability to uninstall the malware via standard user actions means that affected devices remain compromised for their entire usable life. This situation forces enterprises and security vendors to rethink how they assess the trustworthiness of low-cost mobile hardware.

What to do and how to stay safe: Bitdefender

• Review inventory lists for low-cost Android devices, particularly those using MediaTek platforms, to identify potential exposure to preinstalled firmware malware.
• Monitor network traffic for unusual proxy activity or unexpected data flows that could indicate a device is part of a botnet.
• Check for unexpected application installations or background processes that consume resources, as these may signal the presence of dropped malware components.
• Once the vendor provides an update, apply firmware patches immediately to mitigate the persistent threat embedded in the device software.

Step-by-step guide: Ransomware Explained: How File Locking Works and What to Do

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Can users remove Midnight Mimosa malware themselves?

No, the malware is built into the device firmware, so standard uninstall methods do not work and the threat remains persistent.

Which devices are affected by this campaign?

Low-cost Android smartphones that use MediaTek platforms are affected, with the malware observed in 150 countries.

What does the malware do on infected phones?

It generates fake ad clicks, drops additional apps, and builds a proxy botnet for the attackers.