Preinstalled Android Malware “Midnight Mimosa” Embedded in MediaTek Phones Across 150 Countries
What Happened — Bitdefender researchers uncovered a campaign, dubbed Midnight Mimosa, that ships a system‑level Android malware preinstalled in low‑cost MediaTek‑based phones. The malicious component is embedded in the firmware, appears as a harmless “System” app, cannot be removed by the user, and grants the attacker the ability to install/remove apps, hijack accessibility permissions, and download additional code.
Why It Matters for Trust & Control Assurance
- Highlights a supply‑chain control gap: firmware delivered by OEMs or chipset vendors can bypass traditional mobile‑security controls.
- Demonstrates the need for continuous third‑party risk monitoring and immutable evidence that firmware images have not been tampered with.
- Provides a concrete example of why a defensible audit trail of vendor‑provided code (e.g., hash verification, provenance logs) is essential for multi‑framework compliance.
Who Is Affected — Low‑cost Android device manufacturers using MediaTek platforms, their downstream distributors, and end‑users in the 150 countries where the phones are sold.
Recommended Actions
- Incorporate firmware‑integrity verification (hash signing, secure boot) into your device onboarding checklist.
- Extend third‑party risk programs to cover chipset and OEM firmware, collecting continuous assurance evidence (e.g., SBOMs, provenance logs).
- Deploy mobile‑behavior analytics that flag system‑level packages with anomalous permission grants or silent app installs.
Source: SecurityAffairs
Technical Notes
- Malicious package:
com.android.system.litemasquerades as a core Android component. - Uses Accessibility and Notification Access to overlay invisible windows that generate fraudulent ad clicks.
- Drops “cover” apps (weather, lock, OCR) that load legitimate ad SDKs while the hidden component records clicks.
- Operates as a proxy botnet node, enabling DDoS‑as‑a‑service.
Source: Bitdefender Mobile Security research