A malware campaign dubbed Midnight Mimosa has been found baked directly into the firmware of thousands of budget Android phones across more than 150 countries, meaning victims are compromised the moment they turn the device on, long before they install a single app or click a malicious link. Researchers from PolySwarm detailed the campaign’s firmware-level access in a report published October 19, building on roughly two years of infection data collected by Bitdefender.

According to that data, Mexico, France, and Italy have recorded the highest volumes of infected devices, followed by the United States, Germany, Brazil, and Spain. The researchers are careful to note these figures describe where infections have been observed, not confirmed evidence of deliberate targeting by country.

Malware With System-Level Trust Baked In

What makes Midnight Mimosa particularly difficult to deal with is where it lives. The infection begins with a system application signed using an Android platform certificate, the same level of trust normally reserved for core operating system components. That signature gives the malware sweeping privileges: installing and removing apps, granting permissions, and modifying protected system settings, all without triggering the warnings a user would normally see from a suspicious third-party app.

The malicious component hides its real functionality inside a native library, which uses RC4 encryption to unpack a concealed Java-based framework once the device boots. That framework then reaches out to command-and-control servers, pulls down configuration settings, and retrieves additional DEX or JAR plugin modules, essentially letting operators swap in new capabilities at any time without having to replace or re-sign the original system app.

• Bitdefender identified at least 32 disguised consumer apps tied to the wider payload network, including fake weather apps, app lockers, text scanners, and file managers.
• Some plugins exist purely to commit advertising fraud, generating fake ad views, clicks, and conversions through hidden windows and automated interactions.
• A separate set of 13 ad-fraud apps distributed through the official Google Play Store shared malware infrastructure with the firmware-level campaign, though they lacked the same deep system privileges.

Disabling Google Play Protect, Then Restoring It

Before dropping additional malicious payloads, the malware temporarily disables the Google Play Store package on the device and then quietly restores it afterward. Researchers assess this as a deliberate attempt to dodge Google Play Protect scanning during the installation window, rather than evidence that protections remain permanently switched off. Some of the dropped apps go a step further, falsely labeling Google Play as their installation source even though they lack the cryptographic signature that distribution through Play would normally leave behind, a mismatch that gives investigators a reliable way to tell a real Play Store install from a disguised one.

The campaign builds on earlier Midnight Mimosa findings that described how its hidden firmware component persists across device updates even as the visible fraud payloads riding on top of it change over time. That persistence is the core danger: removing one malicious app does not remove the underlying access, since the trusted system component that enabled it in the first place is still there.

Dormant Capabilities Raise Bigger Questions

Beyond ad fraud, researchers found that the malware’s plugin framework includes functions tied to Accessibility Services, Notification Access, and SMS permissions, including mechanisms that can enable these sensitive permissions automatically rather than requiring a user to grant them manually. Investigators say they have not yet observed these particular capabilities being actively used to steal data, but the fact that operators can push new code to infected devices at will means the campaign’s current ad-fraud focus may not reflect what it’s ultimately capable of.

Researchers also found a module containing proxy functionality capable of registering an infected device and opening two-way TCP tunnels, which could theoretically let outside traffic route through a victim’s internet connection. Here too, the team confirmed the underlying capability exists in the code but did not observe it being actively exploited to relay real traffic during testing, and one control server initially flagged in the investigation later turned out to be a sinkhole rather than live attacker infrastructure.

Why Preinstalled Malware Is a Different Kind of Problem

Midnight Mimosa is the latest reminder that device security checks focused solely on what a user downloads miss an entire category of threat baked in before the box is even opened. Earlier cases of preinstalled Android malware have shown the same pattern: no amount of careful app vetting by the end user addresses a threat embedded in the firmware supply chain itself.

For consumers, the practical takeaway is to be cautious with unusually cheap Android devices from unfamiliar brands, particularly those sold through third-party retailers with limited supply chain oversight. For enterprises issuing low-cost devices at scale, this campaign is a strong argument for firmware-level integrity verification and mobile threat defense tools capable of spotting system-level anomalies that a standard app scan would never catch.