The phone was compromised before the user turned it on: the rise of Midnight Mimosa

The report

Bitdefender has identified a malware campaign (dubbed Midnight Mimosa) running on low-cost, multi-brand Android devices built on MediaTek platforms.

Read the full analysis: The phone was compromised before the user turned it on: the rise of Midnight Mimosa (Bitdefender Labs).

Indicators

Malware C

• apple[.]v46wd6uramzkmeeo[.]in
• api[.]weatherlive[.]world

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#10, #12). This page is generated from that record and the report’s own title and summary; nothing is rewritten.