Check Cheap MediaTek Phones for Midnight Mimosa Botnet Generating Fake Ads in 150 Nations
Researchers identify preinstalled malware on low-cost phones that creates a global botnet and generates fake ad revenue across 150 nations.
Key points
- Bitdefender researchers discovered the Midnight Mimosa campaign involving malware preinstalled in device firmware.
- The malicious software targets low-cost Android smartphones utilizing MediaTek processor platforms.
- The botnet operates across 150 countries, generating fraudulent ad clicks and deploying additional apps.
Bitdefender researchers identified a widespread malware campaign named Midnight Mimosa that targets Android devices through preinstalled firmware. The malicious software is embedded directly into the system image of low-cost smartphones, making it difficult for users to remove. According to Security Affairs, this campaign affects devices from various brands that utilize MediaTek hardware platforms. The malware operates as a persistent threat within the device infrastructure.
Root cause
The primary vulnerability lies in the supply chain integration of malicious code into the device firmware. Bitdefender found that the malware is built into the system before the phones reach consumers. This preinstallation method allows the software to persist even after factory resets or standard user interventions. The threat actors leverage the MediaTek platform ecosystem to distribute the compromised firmware across multiple device manufacturers. This approach bypasses traditional application store security checks.
Attack path
Once activated, the Midnight Mimosa malware executes several malicious functions within the operating system. It generates fake ad clicks to generate illicit revenue for the threat actors. The software also drops additional applications onto the infected devices without user consent. Furthermore, the malware recruits the infected phones into a large proxy botnet. This botnet allows attackers to route traffic through compromised devices, masking their true location and identity.
Affected versions
The campaign targets low-cost Android smartphones that use MediaTek processor platforms. Security Affairs reports that the malware has been observed in devices across 150 countries. The specific Android version is less relevant than the hardware platform, as the malware resides in the firmware layer. Devices from various brands are affected, indicating a broad supply chain compromise. Users of budget-friendly phones with MediaTek chips are the primary demographic at risk.
Mitigation
No confirmed fix or update has been released by the affected manufacturers or MediaTek to remove the malware from the firmware. Standard uninstallation methods are ineffective because the software is part of the system image. Users cannot simply delete the app through standard Android settings. Bitdefender recommends avoiding devices from manufacturers known to use compromised firmware images. Enterprise security teams should monitor for unusual network traffic originating from mobile devices.
Background: Threat actors
A threat actor is any individual or group that initiates a security incident. The term distinguishes the person or organization behind the attack from the technical method used. Analysts use this classification to predict future behavior and tailor defenses based on the actor’s goals rather than just their tools.
Read the full guide: Threat Actors Defined: Who They Are and How They Operate
What to do and how to stay safe: Bitdefender
- Audit mobile device management logs for unexpected data usage or proxy traffic patterns that may indicate botnet activity.
- Verify the integrity of device firmware before deploying new smartphones into corporate networks or educational environments.
- Monitor for unauthorized application installations on Android devices, particularly those utilizing MediaTek hardware platforms.
- Once the vendor provides an update, apply firmware patches immediately to any affected devices identified in your inventory.
Step-by-step guide: Offline Backup Mistakes That Break Ransomware Recovery
General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can I remove Midnight Mimosa malware from my phone?
No, because the malware is preinstalled in the device firmware, standard uninstallation methods are ineffective according to Bitdefender researchers.
Which phones are affected by this malware campaign?
Low-cost Android smartphones that use MediaTek processor platforms from various brands are affected by the Midnight Mimosa campaign.
How many countries have seen this malware?
The malware has been observed in devices across 150 countries, creating a global botnet for fraudulent ad clicks.
