Security researchers at Bitdefender have identified a malicious software package named Midnight Mimosa pre-installed on various Chinese smartphones. The malware is embedded directly into the firmware of budget devices powered by MediaTek chipsets, granting it system-level privileges that prevent users from removing it.
The implementation of Midnight Mimosa varies across devices, with unique builds, different signing certificates, and changing names. The software functions as a hub for its operators, allowing them to silently install, remove, and rotate various applications on the affected smartphones. This mechanism helps the operators hide malicious activity and frequently update monetization modules.
The infection has been detected in low-cost counterfeit devices mimicking Samsung and Apple products, as well as in handsets from B-tier brands such as Doogee and Cubot. Analysts suggest that the primary objectives of the operators include generating revenue through clicks on invisible advertisements and utilizing the compromised devices for botnet-driven DDoS attacks.
