MediaTek firmware signed by Shenzhen Zediel carries system-privileged dropper com.android.system.lite on low-cost Android devices

Bitdefender documented the Midnight Mimosa campaign on devices whose firmware bears signing certificates from Shenzhen Zediel Co., Ltd. The package com.android.system.lite executes with system-level rights, fetches remote configuration, disables Play Store during payload drops, then re-enables it. It manages at least 32 rotating apps and can grant any package accessibility, notification, or SMS permissions. Thirteen companion apps on Google Play share the same C2 infrastructure, showing the operation extends beyond supply-chain insertion.

Procurement records and certificate reuse tie the same signing keys to earlier Android.Phantom samples reported by Doctor Web in January 2026. Both campaigns monetize via click-fraud overlays loaded through legitimate ad SDKs and proxyware modules. Geographic concentration in Mexico, followed by Western Europe and the United States, aligns with low-cost device distribution channels rather than targeted espionage. Overlaps in infrastructure suggest shared operators focused on revenue extraction.

The preinstallation vector bypasses post-purchase remediation and evades Play Protect because the dropper runs before user accounts are added. No public CVE exists; the issue is a firmware integrity failure at the OEM level. Similar patterns appear in earlier MediaTek supply-chain cases involving adware in set-top boxes and routers, indicating recurring weak signing practices rather than isolated incidents.

Next steps include independent firmware audits of Zediel and other MediaTek licensees, with expected disclosure of additional affected SKUs once researchers cross-reference certificate hashes. Regulatory pressure on device importers may follow if proxy traffic volumes trigger ISP complaints.