Users should verify device authenticity, enable Play Protect, review installed apps and permissions, monitor for unusual behavior such as data spikes, background activity, or unexpected ads, and consider firmware-level malware or device replacement if infection is suspected; factory resets may not fully remove firmware-level malware and specialized tools or firmware re-flashing may be required.

The malware can generate revenue through advertising fraud by silently displaying or generating clicks and can turn infected devices into residential proxy servers, potentially routing user traffic and enabling larger botnet activity; at least one tested server was a sinkhole, not actively relaying traffic.

Midnight Mimosa is a malware campaign that preinstalls malicious software on certain low-cost Android devices, including firmware-level infection, before the user first powers on the device.

The malware operates with elevated privileges by residing in the system partition, enabling silent installation of apps, removal of existing apps, and remote code execution, while spoofing itself with legitimate-looking package names.

In addition to firmware-based abuse, the campaign also involved malicious apps found on Google Play, though Google Play listings for these apps have since been removed or developers withdrew them; 13 specific apps were identified as part of the operation.

Some affected devices come from brands like Doogee and Cubot, with infections observed across more than 150 countries and multiple model identifiers, including misleading names that imitate premium Samsung or Apple devices.

Midnight Mimosa can temporarily disable Google Play during certain installations to evade Play Protect, then re-enable it after installation; some variants manipulate installer records to appear as if apps came from Google Play.

Bitdefender investigators noted that infected devices can reappear after attempts to remove them, possibly via firmware updates, highlighting the risk of compromised supply chains and the need for responsible manufacturing and marketplace practices.