Midnight Mimosa Malware Infects Global Android Devices
The persistent firmware campaign targets smartphones across more than 150 countries to conduct illicit activities.
Updated on Oct. 20, 2026 in Financial Crime
Live Poll
Do you trust the software preinstalled on low-cost smartphones to be secure and free of malware?
The Midnight Mimosa campaign, active from 2024 to 2026, secretly embeds malicious software within Android firmware. The compromise affects devices globally, turning smartphones into tools for fraud and unauthorized network relay.
Why it matters
This firmware-level infiltration is exceptionally difficult for users to detect or remove, as standard app uninstallation processes are ineffective against the preinstalled compromise.
Bitdefender researchers confirmed the two-year operation spanned over 150 countries, with infections persisting even after standard application removal attempts.
The players
Bitdefender
Bitdefender is a global cybersecurity technology company that provides software and services to protect users from malware and digital threats.
The details
The malware operates by repurposing compromised hardware as residential proxy nodes and advertising fraud engines. Because the malicious code is baked into the firmware prior to the consumer purchase, the device functions as a botnet component without the owner's knowledge.
Timeline
The malicious firmware campaign remained active from 2024 through 2026.
Legal Context
The Midnight Mimosa campaign aligns with historical precedents like the Triada Android trojan, which also leveraged supply chain vulnerabilities to infect device firmware. This trend underscores significant challenges in enforcing mobile security standards across complex international manufacturing chains.
Since the infection occurs at the firmware level, consumers currently have no standard method to identify or purge the malware from affected devices. Affected individuals are advised to monitor their devices for unusual battery drain or unexplained data usage that could indicate proxy botnet activity.
The takeaway
Users should be cautious about purchasing devices from non-verified sources, as firmware compromises can bypass traditional security software. Regularly monitoring network traffic and battery performance remains the most effective way to detect unauthorized background activities on a smartphone.
Further reading
For broader trends regarding digital security threats, visit the Financial Crime section.
Live Poll
Do you trust the software preinstalled on low-cost smartphones to be secure and free of malware?
