Midnight Mimosa Infects Android Phones Before Users Even Turn Them On

Midnight Mimosa is reaching Android phones before their owners even press the power button. The malware arrives inside device firmware, giving its operators a hidden foothold that does not depend on a malicious download, a phishing link, or someone accepting an app permission request. The campaign affects low-cost Android devices from several brands built on MediaTek platforms. Its main purpose appears to be making money through fake advertising activity and residential proxy services, while its system access also allows operators to install apps, remove them, and load new code without asking users. Researchers from Bitdefender identified Midnight Mimosa after their App Anomaly Detection technology flagged a system package behaving unlike a normal…