Midnight Mimosa Android Firmware Supply-Chain Campaign: Phantom, Joker, and DxFactory Loader Detection Pack

The OTX pulse identifies Midnight Mimosa as a widespread Android firmware supply-chain campaign affecting low-cost MediaTek-based devices. Infections have been observed in more than 150 countries. The geographic metadata specifically identifies the United States, Brazil, France, Germany, Italy, Mexico, and Spain, but organizations should treat exposure as global rather than limited to those countries.

The actor remains unattributed. The campaign's defining characteristic is not conventional sideloading or phishing: malicious applications are reportedly embedded in device firmware and signed with platform credentials. That position gives the malware system-level privileges, persistence across ordinary application removal attempts, and potentially across factory resets when the malicious package resides in a protected firmware partition.

The assessed attack chain is:

1. Firmware compromise: Malicious components are introduced during firmware assembly, customization, or downstream distribution for low-cost MediaTek devices.
2. Trusted system application: A package such as com.android.system.lite masquerades as an operating-system component and benefits from platform signing.
3. Loader execution: Java components associated with DxFactory and EnLoaderLib, together with the native libeasy.so library, initialize the infection chain.
4. Remote payload delivery: The loader retrieves or executes remotely supplied code. Named Android families include Phantom, Click, and Joker, although vendor family names can overlap.
5. Monetization: Compromised devices are used for advertising fraud and residential-proxy abuse. The inclusion of Android.Joker also warrants review for premium-service or billing fraud, even though that specific behavior is not asserted in the pulse description.

This is a high-priority exposure for enterprises that permit employee-owned Android devices, issue low-cost mobile hardware, deploy Android-based operational devices, or allow mobile endpoints to access SaaS applications without device-health enforcement.

Threat Actor / Malware Profile

Attribution

Midnight Mimosa is currently unattributed. The breadth of the campaign and placement within firmware indicate access to a device manufacturing, firmware integration, or downstream supply-chain channel. Security teams should not treat the malware family labels as proof of a single actor because the campaign appears to combine multiple monetization modules and reusable loader components.

Component profile

Distribution and persistence

The primary distribution mechanism is preinstallation in Android firmware. Unlike a malicious app installed from a store or sideloaded by a user, a firmware-resident package can be present before first boot, hold privileged permissions, and return after a reset if the reset restores the compromised factory image.

Platform signing is the key persistence and trust-abuse mechanism. It can allow the package to request privileged operations, evade controls designed for ordinary third-party applications, and appear legitimate during cursory package review.

Payload behavior and monetization

The pulse reports silent payload deployment, remotely supplied code execution, mobile security evasion, advertising fraud, and residential-proxy monetization. Residential-proxy abuse is especially important for enterprise risk: victim devices may relay third-party traffic from consumer IP addresses, obscuring the true client and potentially implicating the device owner or organization in unrelated abuse.

Advertising-fraud components may generate hidden requests, automate clicks, install or launch promoted applications, and manipulate attribution SDKs. Joker-associated behavior warrants checks for unauthorized subscriptions, premium SMS interactions, and manipulated notifications, but those behaviors should be confirmed through sample analysis rather than assumed solely from the family label.

C2 and anti-analysis

The supplied IOC sample does not disclose C2 domains, IP addresses, or URLs. The description confirms remotely supplied code, but no network endpoint should be invented from the package names. Analysts should extract network indicators from the full pulse, sandbox execution, and DNS/proxy telemetry before blocking domains.

Observed evasion concepts include:

• Masquerading as a system package.
• Using platform-signed application trust.
• Separating loaders from final payloads.
• Executing remotely supplied code to reduce the static footprint.
• Implementing functionality in native code through libeasy.so.
• Blending malicious requests into advertising or SDK traffic.

Residential-proxy activity can make victim-generated traffic appear to originate from normal consumer address space. That observation relates to monetization and traffic laundering; it is not, by itself, evidence that the malware's C2 infrastructure uses residential proxies.

IOC Analysis

The pulse reports 120 total indicators. The supplied sample contains eight FileHash-MD5 indicators and no visible IP, domain, or URL values. The complete indicator set should be ingested before concluding whether network indicators are present elsewhere in the pulse.

Operationalizing the indicators

• Ingest the complete pulse into MISP, OpenCTI, or the enterprise TIP, preserving indicator type, confidence, tags, and the TLP:WHITE designation.
• Push hashes to mobile EDR and MDM tooling. Exact hash hits are high-confidence for the observed file, but do not automatically establish the file's functional role.
• Scan firmware images before deployment. Extract APKs, DEX files, and native libraries from /system, /product, /vendor, and OEM partitions before calculating hashes.
• Treat package names as behavioral artifacts, not hashes. Names can be reused or slightly changed. Combine package-name matches with signer, installation path, permissions, and network behavior.
• Extract network indicators from execution. Detonate samples in an isolated mobile emulator or physical analysis device and record DNS, HTTP, TLS, and proxy enrollment artifacts.
• Use APK and native-analysis tooling. Useful tools include aapt, apksigner, Apktool, JADX, MobSF, YARA, dex2jar, Ghidra, and Radare2.
• Correlate through network telemetry. If the complete pulse contains domains, URLs, or IPs, route them to DNS security, SWG/proxy, firewall, EDR, and TLS-inspection controls after validation.
• Prefer stronger hashes where available. MD5 is useful for exact legacy sample matching, but SHA-256 should be preferred when the full intelligence set or malware repository provides it.

Package-signing comparison is particularly important. A malicious package named like an operating-system component is not legitimate merely because it is in a privileged path. Compare its signer against the expected device-platform certificate and known-good firmware for the same model and build.

Detection Engineering

The following analytics assume normalized process, network, and Android package-manager telemetry. The custom Android logsource requires field mapping to the organization's MDM or mobile EDR schema. The destination-artifact analytic is a hunting rule because the supplied IOC sample does not publish confirmed C2 hostnames.

Sigma analytics

---
title: Midnight Mimosa Android Loader Artifact Execution
id: 8dc8d75e-bb7f-4c48-a884-40c7e9ee2101
status: experimental
description: Detects known Midnight Mimosa file hashes or process telemetry referencing associated packages, SDK namespaces, and native loader artifacts.
author: Security Arsenal
date: 2026/10/21
modified: 2026/10/21
references:
  - https://blog.polyswarm.io/midnight-mimosa-malware-campaign-exploits-android-firmware-supply-chain
logsource:
  category: process_creation
detection:
  selection_hash:
    MD5:
      - 'a147cd8f72aadfcf78f7723db6813e86'
      - 'f456f0c6b89bd3d5124699d43971d094'
      - '5d29e9b24708c3ec36d1d59036124838'
      - '1414d4ef2d1191080abc59a407dcb6c5'
      - '345057421c7d9ac2b671c47449f35030'
      - '36deebfcda4012d18706cd170c1edf1f'
      - '37f18a20b9cf32e6f07450e903eaad7c'
      - '5b3a49938f455d1197736971c4c07228'
  selection_artifact:
    Image|contains:
      - 'libeasy.so'
      - 'EnLoaderLib'
    CommandLine|contains:
      - 'com.android.system.lite'
      - 'libeasy.so'
      - 'com.wz.sdk.DxFactory'
      - 'com.earnsdk.lib.DxFactory'
      - 'com.gogo.third.lib.DxFactory'
      - 'com.mobile.applock.en'
      - 'EnLoaderLib'
  condition: 1 of selection_*
falsepositives:
  - Security research, malware analysis, or mobile-device inventory scripts referencing the artifact names.
level: high
tags:
  - attack.t1036
---
title: Midnight Mimosa Android Artifact Network Reference
id: 5e15c30a-e209-41e9-9112-6b03e164e934
status: experimental
description: Hunts for network connections associated with Midnight Mimosa process artifacts or destinations containing loader and SDK naming artifacts. A destination-name match is a lead, not confirmed C2 activity.
author: Security Arsenal
date: 2026/10/21
modified: 2026/10/21
references:
  - https://blog.polyswarm.io/midnight-mimosa-malware-campaign-exploits-android-firmware-supply-chain
logsource:
  category: network_connection
detection:
  selection_process:
    Image|contains:
      - 'libeasy.so'
      - 'EnLoaderLib'
    CommandLine|contains:
      - 'com.android.system.lite'
      - 'com.wz.sdk.DxFactory'
      - 'com.earnsdk.lib.DxFactory'
      - 'com.gogo.third.lib.DxFactory'
      - 'com.mobile.applock.en'
  selection_destination:
    DestinationHostname|contains:
      - 'dxfactory'
      - 'enloaderlib'
      - 'libeasy'
  condition: selection_process or selection_destination
falsepositives:
  - Legitimate software-development kits, application-inventory tools, security research, and advertising platforms with similar naming.
level: medium
tags:
  - attack.t1036
  - attack.t1071
---
title: Midnight Mimosa Privileged Android Package Installation
id: 36fb7c99-f356-43f8-a76e-9255420b67e0
status: experimental
description: Detects Android package installation or replacement events involving Midnight Mimosa package and loader artifacts. Map EventType and PackageName to the MDM or mobile EDR schema.
author: Security Arsenal
date: 2026/10/21
modified: 2026/10/21
references:
  - https://blog.polyswarm.io/midnight-mimosa-malware-campaign-exploits-android-firmware-supply-chain
logsource:
  product: android
  service: package_manager
detection:
  selection_event:
    EventType:
      - 'PACKAGE_ADDED'
      - 'PACKAGE_REPLACED'
  selection_package:
    PackageName|contains:
      - 'com.android.system.lite'
      - 'com.mobile.applock.en'
      - 'com.wz.sdk.DxFactory'
      - 'com.earnsdk.lib.DxFactory'
      - 'com.gogo.third.lib.DxFactory'
      - 'EnLoaderLib'
  condition: all of selection_*
falsepositives:
  - Authorized enterprise applications with overlapping SDK namespaces, application research, or controlled test builds.
level: critical
tags:
  - attack.t1036

Microsoft Sentinel hunt query

let Md5Indicators = dynamic([
    "a147cd8f72aadfcf78f7723db6813e86",
    "f456f0c6b89bd3d5124699d43971d094",
    "5d29e9b24708c3ec36d1d59036124838",
    "1414d4ef2d1191080abc59a407dcb6c5",
    "345057421c7d9ac2b671c47449f35030",
    "36deebfcda4012d18706cd170c1edf1f",
    "37f18a20b9cf32e6f07450e903eaad7c",
    "5b3a49938f455d1197736971c4c07228"
]);
let ArtifactNames = dynamic([
    "com.android.system.lite",
    "libeasy.so",
    "com.wz.sdk.DxFactory",
    "com.earnsdk.lib.DxFactory",
    "com.gogo.third.lib.DxFactory",
    "com.mobile.applock.en",
    "EnLoaderLib",
    "Android.Phantom",
    "Android.Click",
    "Android.Joker"
]);
let ProcessHits =
    DeviceProcessEvents
    | where TimeGenerated >= ago(30d)
    | where MD5 in~ (Md5Indicators)
        or FileName has_any (ArtifactNames)
        or ProcessCommandLine has_any (ArtifactNames)
        or FolderPath has_any (ArtifactNames)
    | project
        TimeGenerated,
        DeviceName,
        EvidenceType = "ProcessOrHash",
        Evidence = strcat(FileName, " | ", FolderPath, " | ", ProcessCommandLine),
        MD5,
        RemoteUrl = "",
        RemoteIP = "",
        ReportId;
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated >= ago(30d)
    | where InitiatingProcessMD5 in~ (Md5Indicators)
        or InitiatingProcessFileName has_any (ArtifactNames)
        or InitiatingProcessCommandLine has_any (ArtifactNames)
        or RemoteUrl has_any (ArtifactNames)
    | project
        TimeGenerated,
        DeviceName,
        EvidenceType = "Network",
        Evidence = strcat(InitiatingProcessFileName, " | ", InitiatingProcessCommandLine, " | ", RemoteUrl),
        MD5 = InitiatingProcessMD5,
        RemoteUrl,
        RemoteIP,
        ReportId;
union ProcessHits, NetworkHits
| order by TimeGenerated desc

Android IOC sweep over ADB

Run this read-only script from an authorized forensic workstation against an unlocked, USB-authorized device. Extend the hash array with the remaining indicators from the complete pulse export. Access to some protected paths may require a privileged build or forensic acquisition.

#!/usr/bin/env bash
set -u

SERIAL="${1:-}"
ADB=(adb)
if [[ -n "$SERIAL" ]]; then
  ADB=(adb -s "$SERIAL")
fi

if ! command -v adb >/dev/null 2>&1; then
  echo "ERROR: adb is required" >&2
  exit 2
fi

if ! "${ADB[@]}" get-state >/dev/null 2>&1; then
  echo "ERROR: no authorized Android device is reachable" >&2
  exit 2
fi

HASHES=(
  'a147cd8f72aadfcf78f7723db6813e86'
  'f456f0c6b89bd3d5124699d43971d094'
  '5d29e9b24708c3ec36d1d59036124838'
  '1414d4ef2d1191080abc59a407dcb6c5'
  '345057421c7d9ac2b671c47449f35030'
  '36deebfcda4012d18706cd170c1edf1f'
  '37f18a20b9cf32e6f07450e903eaad7c'
  '5b3a49938f455d1197736971c4c07228'
)

ARTIFACTS=(
  'com.android.system.lite'
  'libeasy.so'
  'com.wz.sdk.dxfactory'
  'com.earnsdk.lib.dxfactory'
  'com.gogo.third.lib.dxfactory'
  'com.mobile.applock.en'
  'enloaderlib'
)

echo '[*] Enumerating system packages'
"${ADB[@]}" shell pm list packages -s -f 2>/dev/null | tr -d '\r' | while IFS= read -r line; do
  lower="$(printf '%s' "$line" | tr '[:upper:]' '[:lower:]')"
  for artifact in "${ARTIFACTS[@]}"; do
    if [[ "$lower" == *"$artifact"* ]]; then
      pkg="${line##*=}"
      echo "[PACKAGE_MATCH] package=$pkg"
      echo "                entry=$line"
      "${ADB[@]}" shell dumpsys package "$pkg" 2>/dev/null \
        | grep -Ei 'versionName|firstInstallTime|lastUpdateTime|installerPackageName|pkgFlags|signatures' \
        | head -n 20
      break
    fi
  done
done

echo '[*] Checking for a device hash utility'
HASH_CMD=()
if "${ADB[@]}" shell 'command -v md5sum >/dev/null 2>&1'; then
  HASH_CMD=(md5sum)
elif "${ADB[@]}" shell 'command -v toybox >/dev/null 2>&1'; then
  HASH_CMD=(toybox md5sum)
else
  echo '[!] md5sum and toybox are unavailable; skipping file-hash scan'
fi

if ((${#HASH_CMD[@]})); then
  echo '[*] Scanning application and native-library paths'
  ROOTS=(
    /system/app
    /system/priv-app
    /product/app
    /product/priv-app
    /vendor/app
    /data/app
  )

  for root in "${ROOTS[@]}"; do
    "${ADB[@]}" shell "test -d '$root' && find '$root' -type f 2>/dev/null" \
      | tr -d '\r' \
      | while IFS= read -r file; do
          case "$file" in
            *.apk|*.dex|*.so) ;;
            *) continue ;;
          esac

          lower_file="$(printf '%s' "$file" | tr '[:upper:]' '[:lower:]')"
          if [[ "$lower_file" == *'libeasy.so'* ]]; then
            echo "[ARTIFACT_MATCH] $file"
          fi

          hash="$("${ADB[@]}" shell "${HASH_CMD[@]}" "$file" 2>/dev/null | awk '{print $1}' | tr -d '\r')"
          for expected in "${HASHES[@]}"; do
            if [[ "$hash" == "$expected" ]]; then
              echo "[HASH_MATCH] $hash $file"
            fi
          done
        done
  done
fi

echo '[*] Checking running processes'
processes="$("${ADB[@]}" shell 'ps -A -o PID,USER,NAME,ARGS 2>/dev/null || ps -A 2>/dev/null')"
if printf '%s\n' "$processes" | grep -Ei 'system.lite|libeasy|dxfactory|enloader|applock'; then
  echo '[!] Process artifact match found; capture package and network context'
else
  echo '[-] No named process artifacts found'
fi

echo '[*] Exporting proxy state and active connections for analyst correlation'
"${ADB[@]}" shell 'settings get global http_proxy; ss -anp 2>/dev/null || netstat -anp 2>/dev/null || cat /proc/net/tcp /proc/net/tcp6 /proc/net/udp /proc/net/udp6 2>/dev/null' \
  | tr -d '\r' \
  | head -n 200

echo '[*] Sweep complete. No files or settings were modified.'

Response Priorities

Immediate

• Import the complete 120-indicator pulse into the TIP and push validated hashes to mobile EDR, MDM, firmware-scanning, and malware-analysis platforms.
• Quarantine or network-isolate devices with exact hash matches or package artifacts. Do not rely on ordinary uninstallation for a platform-signed firmware application.
• Hunt for com.android.system.lite, libeasy.so, all three DxFactory namespaces, EnLoaderLib, and com.mobile.applock.en across mobile application inventories.
• Identify affected device models, OEMs, firmware build numbers, procurement channels, and platform-signing certificates.
• Capture DNS, proxy, VPN, and egress telemetry from suspected devices. Look for advertising-fraud bursts, unexpected proxy enrollment, high-volume connections, and traffic inconsistent with the device's normal role.
• Block validated network indicators from the complete pulse at DNS, secure web gateway, firewall, and mobile EDR controls. Do not block inferred domains that were not observed.
• Preserve firmware images and application evidence before reflashing or replacing a device.

Within 24 hours

• Confirm whether each suspected package is platform-signed, where it resides, whether it can be disabled, and whether it returns after removal or reset.
• Compare the package signer against a known-good firmware image for the same device model and build.
• Review carrier charges, premium SMS activity, subscription prompts, hidden notifications, advertising requests, and residential-proxy or VPN configuration changes.
• The pulse does not explicitly identify credential theft. However, because the loader can execute remotely supplied code and relay traffic, treat enterprise tokens and cookies on confirmed devices as potentially exposed.
• Revoke active SaaS sessions, force reauthentication, rotate enterprise credentials used on confirmed devices, and review impossible-travel or token-replay detections.
• Temporarily block confirmed devices from corporate email, VPN, SaaS, and device-trust policies until they are replaced or restored from validated firmware.
• Contact the device vendor or supplier with model, build, package signer, hash, and purchase-chain evidence.

Within one week

• Remove affected device models from procurement until firmware provenance and signing controls are validated.
• Require firmware SBOMs, reproducible build evidence, platform-key protection details, and signed update chains from mobile hardware suppliers.
• Enforce Android Verified Boot, Play Protect, current security-patch levels, MDM application inventory, and restrictions on untrusted device models.
• Establish a pre-deployment firmware scanning process that extracts APKs, DEX files, native libraries, certificates, permissions, and embedded network strings.
• Segment mobile and operational Android devices from sensitive internal networks and require device-health checks for SaaS access.
• Deploy detections for package-name artifacts, privileged package replacement, unexpected proxy configuration, advertising-fraud traffic patterns, and native-library loading.
• Add supply-chain acceptance testing for low-cost Android, IoT, kiosk, scanner, point-of-sale, and operational-technology devices.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub