Bitdefender says Midnight Mimosa was preinstalled in the firmware of some low-cost, multi-brand Android phones built on MediaTek platforms. Because its persistent system component is not removed by an ordinary app uninstall, Bitdefender describes firmware cleanup or disabling it through ADB as possible routes, though neither is realistic for most affected owners.
How Midnight Mimosa gets onto a phone
Firmware is the low-level software that helps a device run. Bitdefender says the malware’s system component was already installed before an affected phone’s first startup. Its findings concern some low-cost, multi-brand Android devices built on MediaTek platforms, not every budget Android phone.
Bitdefender says it observed the campaign on thousands of unique devices in more than 150 countries over roughly two years. Those detections describe the campaign’s observed reach, not the share of phones infected in any country.
What the malware can do
The persistent system component can silently install and remove apps, grant permissions, and load code supplied remotely, according to Bitdefender’s technical analysis. The researchers also report hidden ad impressions and clicks, along with devices acting as residential-proxy relays, routing traffic through a user’s internet connection.
Bitdefender describes a rotating family of at least 32 disguised payload apps. It also identified 13 Google Play apps carrying the same family markers. The malware reportedly disables the Play Store app immediately before installing a payload, then re-enables it, apparently to avoid detection by Play Protect. These reported capabilities and activities do not mean every affected phone experienced each behavior.
Why removing an app may not be enough
Bitdefender says the persistent component sits in the system partition, so uninstalling it through the normal app-removal process does not remove it. The routes the company describes are firmware-level cleanup or disabling the component through ADB, the Android Debug Bridge, a tool for communicating with an Android device from a computer. Bitdefender says neither option is realistic for most affected owners.
A payload app and the component that installs it are different parts of the problem. Removing an app does not remove a persistent component embedded in the phone’s firmware, which is why the cleanup options Bitdefender describes involve the firmware or ADB.
