Midnight Mimosa Preinstalls System-Level Firmware Malware on MediaTek Budget Androids in 150+ Countries

The malware arrives as an unremovable system app baked into device firmware before sale. On first boot it establishes C2 contact, suppresses Play Protect during payload drops, and grants itself package management rights. Bitdefender documented this exact behavior on devices shipped to Mexico, France, Italy, the US, Germany, Brazil, and Spain with no single region dominating volume. The campaign pairs factory persistence with 13 Play Store apps sharing identical ad-fraud markers under two developer accounts.

Supply-chain insertion at the MediaTek ODM tier explains the geographic spread and removal resistance. Unlike post-install trojans, this variant survives factory resets and normal uninstall flows because it runs with signature-level privileges from the system partition. The same infrastructure disables Play Store briefly to blind Google scanners, then re-enables it, a tactic observed in prior supply-chain campaigns against router and IoT firmware but rarely documented at Android handset scale.

Monetization centers on automated ad fraud and rentable proxy nodes. Operators can tune each device remotely, installing or removing apps to match campaign needs without user interaction. This model mirrors earlier preinstalled adware clusters but adds C2-driven botnet flexibility, increasing the value of each compromised handset on underground markets.

Next indicators will appear in new MediaTek chipset firmware builds and ODM contract awards. Procurement records from mid-tier brands sourcing from the same factories should be monitored for sudden increases in returned devices or anomalous Play Protect suppression telemetry.