CTI · reported · 2026-10-09

Midnight Mimosa: Preinstalled Android malware in MediaTek firmware

Full story & timeline

Actors

—

Malware / tools

Midnight Mimosa

Campaigns

Midnight Mimosa

CVEs

—

Victim sectors

consumermobile

Geography

global

MITRE ATT&CK

T1019 System Firmware Persistence
T1071 Application Layer Protocol Command and Control
T1496 Resource Hijacking Impact
T1036 Masquerading Stealth

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Midnight Mimosa Preinstalled Android Malware C2 Beaconing
id: 539aa3c9-f0cb-4659-a4ba-c923539a9468
status: experimental
description: >
    Detects network connections to api.weatherlive[.]world, the weather-API
    masquerade used as command-and-control by Midnight Mimosa, the
    platform-signed Android malware preinstalled in low-cost MediaTek firmware
    (Bitdefender, October 2026). Infected devices beacon to this host for ad
    fraud, click fraud and residential-proxy tasking across 150+ countries.
references:
    - https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
    - https://www.securityweek.com/pre-baked-firmware-malware-hits-budget-android-devices-in-150-countries/
author: Tia N. List
date: 2026-10-09
tags:
    - attack.t1071
    - attack.t1036
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|endswith: 'api.weatherlive.world'
    condition: selection
falsepositives:
    - Legitimate weather-api applications do not use this exact hostname; verify DNS/proxy logs before acting
    - Security research and sandbox detonation of the malware family
level: high

YARA-X raw

rule Midnight_Mimosa_Firmware_Implant {
    meta:
        author = "Tia N. List"
        date = "2026-10-09"
        status = "experimental"
        description = "Midnight Mimosa platform-signed system application preinstalled in low-cost MediaTek Android firmware; rotating package names and a weather-API C2 hostname documented by Bitdefender. Derived from case analysis — NOT validated against a live sample."
        reference = "https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware"
        falsepositives = "Benign system packages share the com.android prefix; require two package-name hits or one package name plus the C2 hostname before acting"
    strings:
        $pkg1 = "com.android.system.lite" ascii nocase
        $pkg2 = "com.android.sys.prot" ascii nocase
        $pkg3 = "com.android.sys.gmsprot" ascii nocase
        $pkg4 = "com.android.sys.bcprot" ascii nocase
        $c2 = "api.weatherlive.world" ascii nocase
    condition:
        2 of ($pkg*) or ($c2 and 1 of ($pkg*))
}

References

Source on GitHub