Midnight Mimosa Malware Preinstalled on Low‑Cost Android Phones
What Happened – Researchers discovered that a variant of the “Midnight Mimosa” malware is embedded in the firmware of several inexpensive Android handsets before they leave the factory. The malicious code can silently collect user data, monitor activity, and communicate with command‑and‑control servers once the device is powered on.
Why It Matters for Trust & Control Assurance
- Demonstrates a supply‑chain control gap: without continuous vendor‑risk monitoring, compromised hardware can bypass traditional endpoint defenses.
- Highlights the need for verifiable evidence that third‑party firmware meets your organization’s security baselines.
- Aligns with the control objective of vendor oversight and supply‑chain assurance, a single control that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – Mobile device resellers, enterprises that provision low‑cost Android phones to employees, and manufacturers of budget Android hardware.
Recommended Actions
- Inventory all Android devices in use and identify any low‑cost models sourced from the affected manufacturers.
- Verify firmware integrity using cryptographic hashes or trusted‑boot mechanisms; replace devices that cannot be validated.
- Incorporate firmware‑integrity checks into your continuous third‑party risk monitoring program and retain evidence for audit readiness. Source: https://hackread.com/midnight-mimosa-malware-preinstalled-android-phones/
Technical Notes – The malware is baked into the device’s bootloader firmware, evading standard OS‑level anti‑malware tools. It activates on first boot, captures contacts, SMS, and location data, and exfiltrates via HTTPS to a hard‑coded C2 domain. No public CVE is associated because the issue resides in the hardware supply chain rather than a software vulnerability. Source: https://hackread.com/midnight-mimosa-malware-preinstalled-android-phones/