The phone was compromised before the user turned it on: the rise of Midnight Mimosa

Bitdefender researchers uncovered "Midnight Mimosa", a preinstalled, platform-signed Android system app family (e.g., com.android.system.lite and variants) on low-cost, MediaTek-based devices that RC4/AES-decrypts and loads an encrypted framework (libeasy.so → cn.kw.lib), fetches stage-2/3 plugins from api.weatherlive.world/oss.showtimetool.com, and silently installs rotating cover apps used for large-scale ad/click fraud and residential-proxy botnets; the enabler can grant privileged permissions, disable Play Protect during installs, spoof installer provenance, is persistent in firmware (not user-removable), has live C2 infrastructure and Google Play–distributed app variants, and was observed on thousands of devices across 150+ countries with extensive IOCs provided.