Are Cheap MediaTek Android Phones Infected With Midnight Mimosa Before You Turn Them On?
Bitdefender researchers found supply-chain malware on low-cost Android devices that compromises phones before users ever power them on.
Key points
- Bitdefender Labs identified the Midnight Mimosa malware campaign targeting MediaTek-based Android devices.
- The infection occurs in the supply chain before the device is first powered on by the end user.
- The malware affects low-cost, multi-brand Android phones built on MediaTek platforms.
Bitdefender Labs published first-hand research revealing a supply-chain malware campaign dubbed Midnight Mimosa. The researchers identified this threat running on low-cost, multi-brand Android devices that are built on MediaTek platforms. This discovery highlights a significant security risk where the compromise happens before the user ever interacts with the device.
Root cause
The core issue lies in the manufacturing and distribution process of these specific Android devices. According to Bitdefender Labs, the phones were compromised before the user turned them on. This indicates that the malware was likely injected during the production or shipping phase, rather than through a user action like downloading a malicious app.
Attack path
The attack vector is a supply-chain infection. The malware resides on the device hardware or firmware before the initial boot sequence. When the user finally powers on the phone for the first time, the malicious code is already present and active. This bypasses traditional security checks that occur after the operating system is fully loaded and user accounts are created.
Affected versions
Bitdefender’s research specifies that the affected devices are low-cost Android phones. These devices are built on MediaTek platforms and come from multiple brands. The researchers did not specify particular Android version numbers or specific model identifiers in the summary, but emphasized the hardware platform and cost tier as the common denominators for the infection.
Mitigation
No specific software patch or firmware update has been confirmed by the vendors or Bitdefender in the provided material. Users cannot simply update the phone to remove the threat if the compromise occurred at the hardware or deep firmware level before first boot. The lack of a confirmed fix means that affected devices may remain vulnerable regardless of standard software maintenance routines.
What to do and how to stay safe: Bitdefender
- Inspect the device for unusual behavior or pre-installed apps that you did not request, especially on low-cost phones.
- Check for official security advisories from the phone manufacturer or MediaTek regarding supply-chain issues.
- Avoid entering sensitive credentials or banking information on devices that may have been compromised before first use.
- Monitor your accounts for unauthorized access if you have already used a potentially infected device.
General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Midnight Mimosa malware?
Midnight Mimosa is a malware campaign identified by Bitdefender Labs that runs on low-cost Android devices built on MediaTek platforms.
When does the infection occur?
The infection occurs before the user turns on the phone, meaning the device is compromised during the supply chain process.
Which devices are affected?
The malware affects low-cost, multi-brand Android devices that are built on MediaTek platforms, according to Bitdefender research.
