A widespread cybersecurity issue has been uncovered involving low-cost Android devices that come pre-installed with malware. This campaign, identified as Midnight Mimosa, has been discovered by Bitdefender researchers. The malware is embedded directly into the device firmware, making it nearly impossible to remove through conventional methods. Once activated, the malware grants bad actors system-level privileges, allowing them to remotely control the affected device via a command-and-control server. This includes installing or removing apps, granting permissions, and executing arbitrary code.

The primary aim of Midnight Mimosa is ad fraud and automated click fraud, turning affected devices into components of a larger botnet. This botnet can be rented out to other malicious actors, increasing its value. Over the past two years, thousands of unique devices have been affected globally, spanning more than 150 countries with significant impacts in Mexico, France, Italy, the US, Germany, Brazil, and Spain. While the campaign primarily involves pre-installed firmware, Bitdefender also identified 13 apps on Google Play with similar malware characteristics, expanding the malware's reach further.

These apps, although lacking the privileged access of pre-installed malware, are part of the broader ecosystem of this campaign. They have been observed to disable the Google Play Store during the installation of additional payloads, potentially to bypass Google's security measures. Midnight Mimosa represents a significant supply chain threat, as the malware is deeply integrated into devices before they hit the market. This allows attackers to maintain extensive control over these devices, posing a persistent threat to users worldwide.