The phone was compromised before the user turned it on: the rise of Midnight Mimosa

Bitdefender documents the Midnight Mimosa Android malware campaign, a multi-name, platform-signed enabler that preinstalls a malicious system component on low-cost MediaTek devices to silently deploy a rotating portfolio of hidden payloads, disable Play Protect, and perform ad fraud and residential-proxy operations via a remote-configured plugin architecture. The campaign spreads through infected firmware and Google Play apps, uses a C2 infrastructure at api.weatherlive.world, and impacts thousands of devices across 150+ countries, with attribution clues to Shenzhen Zediel and a broad ecosystem of enablers and droppers.