Midnight Mimosa: An Emerging Threat in Android Malware
Midnight Mimosa has emerged as a significant Android malware campaign that stealthily embeds itself in the firmware of various smartphones, capitalizing on compromised devices for deceptive advertising schemes and providing residential proxy services. This malware operation, which was disclosed on October 8, has reportedly compromised thousands of devices across more than 150 countries over the past two years. Its primary targets have been low-cost smartphones that utilize MediaTek platforms, making it particularly pervasive in markets where these devices are abundant.
This malware operates under a distinct mechanism; unlike many cyber threats that require users to download malicious files inadvertently, Midnight Mimosa gains access to devices even before they reach their owners. Embedded as a privileged system component, it quietly installs or removes applications, alters permissions, and retrieves executable code without arousing suspicion. As researchers continue to investigate, the specific entry point into this hardware supply chain remains unclear, and there is no conclusive evidence establishing that MediaTek is responsible for the infection.
The malicious components of Midnight Mimosa have been identified under several names, including com.android.sys.prot, com.android.sys.gmsprot, and com.android.sys.bcprot. These package names mimic legitimate Android components to evade detection. However, security experts highlight that shared malicious functionalities exist within these components, rather than relying on any individual name as a definitive identification marker.
One of the more impactful elements of this malware is a native library known as libeasy.so. This component is responsible for decrypting a hidden framework that seeks remote configuration data from infrastructure disguised as a weather service. Furthermore, additional plugins facilitate silent installations and advertising functionalities, reinforcing the malware’s deceptive nature. Malicious files often utilize misleading extensions, such as JAR components that appear as .o files or APK payloads masqueraded as .png images, complicating the static inspection process.
Midnight Mimosa is particularly adept at manipulating various permissions, including Accessibility, Notification Access, and SMS privileges. Notably, researchers observed that, although these capabilities could pose a risk, they were not actively exploited for surveillance purposes. Before deploying some of its payloads, the malware temporarily disables com.android.vending, the Google Play Store package, seemingly to evade detection by Play Protect.
According to Bitdefender researchers, their investigation was initiated upon detecting suspicious activity from a package labeled com.android.system.lite—a seemingly innocuous “System” application lacking an icon. They later uncovered that at least 32 applications dropped by Midnight Mimosa were masquerading as beneficial tools, such as weather apps, file managers, and note-taking utilities.
These disguised applications are designed to present legitimate advertisements through recognized advertising services, while in the background, hidden windows generate impressions without user engagement. The regional distribution of compromised devices is extensive, with Mexico, France, and Italy leading in infection rates, followed closely by the United States, Germany, Brazil, and Spain.
Additional components within the malware ecosystem rely on synthetic clicks to transform covert actions into revenue. Advertising plugins can invoke unwanted overlays when a user interacts with their device, and secure window flags prevent these overlays from being captured in screenshots. By implementing timing restrictions and daily click limits, the malware optimizes its operations to appear less suspicious while concurrently distributing its advertising activities across various payloads.
In a distinct aspect of the operation, another payload—designated as com.mobile.applock.en—functions as a TCP proxy without any user interface or advertisement features. This component connects over port 6000 to relay targeted traffic to remote locations, effectively repurposing the device’s connection as part of a residential proxy network. Researchers noted the potential for utilizing this network in creating a botnet or for Distributed Denial of Service (DDoS) applications, although no documented DDoS campaigns have been linked to this malware.
Interestingly, the investigation uncovered thirteen applications from the Google Play Store that communicated with Midnight Mimosa’s infrastructure and contained similar advertising fraud code. Unlike the stealthy firmware implants, these store applications did not possess equivalent system privileges but provided somewhat legitimate functionalities. This indicates that the operators are employing a mixed approach, combining preinstalled privileged access with traditional app distribution techniques, rather than relying solely on compromised firmware.
While some affected firmware has been traced back to certificates associated with Shenzhen Zediel, it’s essential to note that certificate attribution does not imply authorial intent or complicity in the distribution of the malware. Moreover, overlaps in infrastructure with previously documented threats like Android.Joker, Android.Phantom, and Click activity further complicate the attribution landscape. However, such connections should not be misinterpreted as definitive evidence linking these activities to a specific threat actor.
Given that the persistent component of Midnight Mimosa resides within the system partition of infected devices, traditional uninstallation methods are ineffective. Effective remediation demands either trusted firmware cleanup or direct intervention from device vendors. Cybersecurity experts emphasize the need for behavioral monitoring and verified firmware sources, rather than solely relying on package name blocklists, to secure devices from these sophisticated threats.
Indicators of Compromise
The ongoing investigation has identified several key indicators associated with Midnight Mimosa’s malicious activities. These include:
- api.weatherlive[.]world/br_upgrade/upgradeV2/getConfigs: This link serves as the control channel for the AES/HmacMD5 module.
- api.weatherlive[.]world/odborwer_dot/cm: This telemetry beacon known as DotReporter offers insights into the malware’s communication patterns.
- Additional domains like oss.showtimetool[.]com, which funnelling payloads as disguised images, further illustrate the malware’s complexity.
For cybersecurity professionals, recognizing these indicators is crucial for identifying and mitigating the risks posed by the Midnight Mimosa operation.