Cybersecurity

Midnight Mimosa Malware Hits Android Devices in 150+ Countries

A pervasive firmware-level Android malware campaign known as Midnight Mimosa has been uncovered, impacting low-cost budget devices across more than 150 countries worldwide.

Radwan AbdulhadiEditor and technology writer

Published: October 9, 2026 · Updated: October 9, 2026 · 3 min read

Midnight Mimosa Malware Hits Android Devices in 150+ Countries — Image: SecurityWeek

Preinstalled Firmware Threat Spreads Globally

A newly uncovered malware campaign designated as Midnight Mimosa has emerged, specifically targeting the global market for low-cost Android devices. Bad actors have capitalized on the high demand for budget smartphones by shipping devices built on MediaTek platforms with malicious code preinstalled directly into the firmware. As detailed by [SecurityWeek](https://www.securityweek.com/pre-baked-firmware-malware-hits-budget-android-devices-in-150-countries/), the malware remains completely unseen and persistent when a recipient switches on an affected device for the first time.

Because the malicious software operates as a preinstalled firmware system app, it cannot be removed through normal device uninstallation procedures. This supply-chain threat ensures that attackers maintain extensive control over the affected hardware right from the start, allowing them to manage remote payloads and execute proxy-network abuse without immediate user awareness.

System-Level Privileges and Botnet Integration

The campaign was thoroughly uncovered and [analyzed](https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware) by security researchers, who noted that the malware possesses massive potential for remote command and control (C2) operations. Operating with system-level privileges, Midnight Mimosa allows bad actors to silently install and remove applications, grant unauthorized permissions, and load arbitrary code supplied remotely from a C2 server.

According to findings outlined by Bitdefender, operators can tune each compromised device to their specific needs, including integrating them into large botnets. The primary focus of Midnight Mimosa centers on ad fraud, automated click fraud, and expanding a lucrative botnet infrastructure that can be rented out to other cybercriminals.

Global Distribution and Impact Across Regions

Over the past two years, researchers have tracked thousands of unique affected devices spanning more than 150 countries worldwide. The distribution data reveals that no single region entirely dominates the spread of Midnight Mimosa, though Mexico and France currently lead in infection volumes, followed closely by Italy, the United States, Germany, Brazil, and Spain.

Regionally, Western Europe and the Americas stand out as primary focal points for the campaign. While the researchers noted that the specific monetary gains achieved by the operators remain unclear, the widespread proliferation highlights the severe risks associated with budget hardware supply chains.

Expansion Into Google Play and Evasion Tactics

In addition to preinstalled firmware vectors, the threat actors have expanded their reach through traditional application marketplaces. Researchers identified 13 separate apps published on Google Play under two developer accounts carrying the exact same Midnight Mimosa ad-fraud code and family markers.

Although these Google Play apps lack the deep system-level privileges of the firmware variant, they provide attackers with an additional distribution channel within the broader ecosystem. Whether the malicious code arrives preinstalled or is downloaded from the store, the malware has been observed temporarily disabling Google Play and blinding Google Play Protect during the installation of extra payloads to avoid detection.