Related Families: Midnight Mimosa, Android.Phantom, Android.Click, Android.Joker
Executive Summary
Midnight Mimosa is a widespread Android malware campaign involving malicious applications preinstalled in the firmware of low-cost, MediaTek-based devices, with infections observed across more than 150 countries. The malware leverages platform-signed system applications to silently deploy additional payloads, evade mobile security protections, execute remotely supplied code, and monetize compromised devices through advertising fraud and residential-proxy services. The campaign poses potential risks to organizations using inexpensive or unmanaged Android devices, as compromised hardware can facilitate unauthorized network activity and maintain persistent malicious functionality that conventional application removal cannot address.
