CTI · reviewed · 2026-10-09

Midnight Mimosa: ad-fraud malware preinstalled in cheap Android phone firmware

Full story & timeline

Actors

—

Malware / tools

Midnight Mimosa

Campaigns

Midnight Mimosa

CVEs

—

Victim sectors

consumermobile

Geography

MexicoFranceItalyUnited StatesGermanyBrazilSpainglobal

MITRE ATT&CK

T1019 System Firmware Persistence
T1105 Ingress Tool Transfer Command and Control
T1071 Application Layer Protocol Command and Control
T1090 Proxy Command and Control
T1036 Masquerading Stealth
T1496 Resource Hijacking Impact

Indicators

Observables tied to this case, from the curated feed. raw sidecar

api.weatherlive domain · active
com.android.sys.bcprot domain · active
com.android.sys.gmsprot domain · active
com.android.sys.prot domain · active
com.android.system.lite domain · active

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Midnight Mimosa Payload CDN and Proxyware Control Connections
id: 58838ad6-9196-4517-8511-41c68409b938
status: experimental
description: >
    Detects network connections to the Midnight Mimosa payload CDN
    oss.showtimetool.com (which serves implant modules disguised as .png
    files), the proxyware control endpoint 85.17.70.38:6000, and the
    documented telemetry beacons 39.96.8.180:9008 and 120.78.215.151:80 of
    the platform-signed Android firmware implant preinstalled in low-cost
    MediaTek devices (Bitdefender, October 2026). Complements the
    api.weatherlive[.]world C2 rule by covering the delivery and relay legs
    of the infrastructure.
references:
    - https://www.bleepingcomputer.com/news/security/low-cost-android-phones-ship-with-residential-proxy-malware/
    - https://fawkes.rocks/2026/10/08/midnight-mimosa-cheap-android-phones-ship-ad-fraud-malware/
author: Tia N. List
date: 2026-10-09
tags:
    - attack.t1071
    - attack.t1090
logsource:
    category: network_connection
    product: windows
detection:
    selection_cdn:
        DestinationHostname|endswith: 'oss.showtimetool.com'
    selection_proxyware:
        DestinationIp: '85.17.70.38'
        DestinationPort: 6000
    selection_telemetry:
        DestinationIp:
            - '39.96.8.180'
            - '120.78.215.151'
    condition: selection_cdn or selection_proxyware or selection_telemetry
falsepositives:
    - Security research, threat intel tooling and sandbox detonation reaching these endpoints
    - Rare legitimate traffic to these hosts is not expected; verify device inventory and DNS/proxy logs before acting
level: high