Preinstalled Android Malware ‘Midnight Mimosa’ Infects Devices Before First Power‑On
What Happened — Bitdefender researchers uncovered a malware campaign, dubbed Midnight Mimosa, that is baked into the firmware of low‑cost Android phones built on MediaTek platforms. The malicious system app is present before the user powers on the device and cannot be removed, granting system‑level privileges to silently install, remove, and control other apps.
Why It Matters for Trust & Control Assurance —
- It is a supply‑chain breach that shows a failure to enforce firmware integrity – a control‑area that continuous‑monitoring programs are built to verify.
- The campaign underscores the need for documented third‑party component vetting and ongoing assurance that pre‑installed software complies with security baselines.
- System‑level permissions are abused for ad‑click fraud and botnet recruitment, highlighting the importance of having a defensible audit trail for remediation actions.
Who Is Affected — Consumers and enterprises using inexpensive Android smartphones from multiple OEMs, especially devices based on MediaTek chipsets; mobile‑app ecosystems that rely on these devices.
Recommended Actions —
- Map the supply‑chain integrity control to your audit framework and collect firmware signing evidence.
- Deploy mobile‑device management (MDM) tools that can detect unauthorized system apps and enforce baseline configurations.
- Require OEMs to provide signed firmware attestations and incorporate continuous verification into your vendor‑risk program. Source: https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
Technical Notes — The malware installs a platform‑signed system app (e.g., com.android.system.lite) that gains Accessibility, Notification Access, and SMS permissions, and can load arbitrary code from remote C2 servers. It rotates through at least 32 disguised apps and communicates with 13 Google‑Play apps that act as proxies. Source: https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware