MediaTek Android Firmware Rootkit Grants Silent Control Before Power-On
Bitdefender researchers found a supply chain infection that grants attackers silent control over low-cost devices before owners power them on.
Key points
- The malware resides in device firmware, bypassing standard app permission checks and user downloads.
- Bitdefender identified the threat across thousands of devices in more than 150 countries over two years.
- Operators use the access to generate fake ad revenue and manage residential proxy networks.
A firmware-level rootkit named Midnight Mimosa is compromising Android devices before users activate them. According to Cyber Security News, the malware embeds itself in the system image, granting operators persistent access without requiring phishing links or malicious app installations. This supply chain infection affects low-cost phones built on MediaTek platforms, allowing attackers to install or remove applications silently while bypassing normal security controls.
Root cause
Bitdefender researchers discovered the threat using App Anomaly Detection technology, which flagged a system package behaving abnormally. The component, labeled "System," runs under Android’s system user and is signed with a platform certificate. This high-level privilege allows it to grant permissions and install packages without user consent. Because it resides in the firmware rather than as a standard app, it cannot be removed through the phone’s usual uninstall interface.
Attack path
The malware conceals its core logic within a native library file. During device startup, this library decrypts an embedded APK using the RC4 algorithm to load a hidden Java framework. This framework then downloads additional DEX and JAR modules from remote servers. To evade detection, some JAR files use object-file extensions, while downloadable modules are disguised as PNG image files. These modules enable operators to execute fake ad clicks and modify device behavior post-purchase.
Affected versions
The campaign targets low-cost Android devices from multiple brands utilizing MediaTek chipsets. Bitdefender’s report, published on October 8 and updated on October 9, documents infections across more than 150 countries. Mexico, France, and Italy showed the highest distribution rates, followed by the United States, Germany, Brazil, and Spain. Some infected devices also displayed counterfeit flagship model names, complicating hardware identification.
Mitigation
No software patch or firmware update has been confirmed by vendors to remove the existing infection. Since the malware is baked into the system image, standard security scanners may not detect it as a removable app. Users cannot fix the issue by uninstalling apps or resetting settings. The only reliable mitigation is to avoid purchasing devices from unverified sellers or brands known for counterfeit hardware labels.
Background: Phishing
Phishing tricks you into taking action by disguising malicious intent as legitimate communication. You stop it by verifying sources, using passkeys, and treating every unsolicited request as suspicious until proven otherwise. Technical controls like email authentication and network segmentation reduce risk but cannot eliminate human error.
Read the full guide: Phishing Defenses: Answers to 10 Critical Questions
What to do and how to stay safe: Midnight Mimosa
- Check device specifications against official manufacturer databases to verify hardware authenticity.
- Monitor for unexpected app installations or permission changes that you did not authorize.
- Watch for unusual data usage spikes that could indicate background proxy activity.
- Avoid buying unlocked phones from third-party marketplaces with poor vendor verification.
Step-by-step guide: Incident Response Plan for Ransomware Attack: Stop the Spread
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can I remove Midnight Mimosa by wiping my phone?
No, because the malware is embedded in the firmware and cannot be removed through standard uninstall or reset functions.
Which Android devices are at risk?
Low-cost devices built on MediaTek platforms from several brands, particularly those sold in Mexico, France, and Italy.
Does this malware steal passwords or banking data?
The source material states the main purpose is fake advertising activity and residential proxy services, not direct data theft.
