Is Midnight Mimosa Firmware Malware Hidden on Your Cheap Android Phone?

A malware campaign named Midnight Mimosa is currently running on low-cost Android devices. The software is preinstalled in the device firmware before the phones reach consumers. This means the malicious code is present from the moment the user powers on the device. SecurityWeek reported that this firmware-level infection affects budget smartphones sold in more than 150 countries.

How does this malware reach users before activation?

The malware is baked into the firmware of the devices. This occurs before the phones are sold to consumers. Attackers compromise the manufacturing or distribution supply chain to inject the code. Unlike apps downloaded from stores, this code is part of the system image. It loads automatically when the device boots up.

Why are budget Android phones the primary target?

Low-cost Android devices are the specific target of this campaign. These phones often have weaker supply chain security controls. Manufacturers of budget hardware may rely on third-party firmware providers or lack rigorous testing. This makes them vulnerable to pre-installation attacks. The low price point also suggests a higher volume of sales, maximizing the attacker's reach.

How widespread is this firmware infection campaign?

The campaign is extremely widespread geographically. According to SecurityWeek, infected devices have been found in more than 150 countries. This global distribution indicates a large-scale operation. It suggests that the compromised firmware is shipped from major manufacturing hubs. The sheer number of affected nations makes tracking every infected device difficult.

What is the immediate risk to developers and users?

The immediate risk is that the device is compromised at the lowest level. Standard security apps may not detect firmware-level threats. Users cannot remove the malware simply by deleting an app. Developers testing on these devices may encounter unexpected behavior or data leaks. The persistence of firmware malware makes it hard to clean.

Background: Data leaks

Detect leaks by correlating user behavior anomalies with network egress logs. Monitor for unusual data volumes, off-hours access, and connections to unknown external IPs. Use Data Loss Prevention tools to scan for sensitive patterns, but focus on establishing a baseline of normal activity to identify deviations that indicate theft.

Read the full guide: Detect Data Leaks in Logs and Network Traffic

What to do and how to stay safe: Midnight Mimosa

• Check your device manufacturer’s website for any firmware security bulletins regarding preinstalled software anomalies.
• Avoid purchasing Android devices from unknown or unverified third-party sellers, especially if the price is unusually low.
• Monitor system logs for unexpected processes or network connections that occur immediately after booting the device.
• Use a secondary, verified device to handle sensitive data until the source of the firmware compromise is fully understood.

Step-by-step guide: Build an Incident Response Plan That Actually Works

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Can I remove Midnight Mimosa with a factory reset?

No, because the malware is embedded in the firmware, a standard factory reset will not remove it. The code remains in the system partition.

Which countries are affected by this malware?

The malware has been found on devices in more than 150 countries, according to SecurityWeek. It is a global issue.

Is this malware present on high-end Android phones?

The report specifically identifies low-cost and budget Android devices as the targets. High-end devices are not mentioned as affected.