#ParsedReport #CompletenessHigh
08-10-2026

The phone was compromised before the user turned it on: the rise of Midnight Mimosa

https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware

Report completeness: High

Threats:
Midnight-mimosa
Residential_proxy_technique
Supply_chain_technique
Gogo_tool
Joker

Industry:
Logistic, Retail, E-commerce

Geo:
France, Americas, United states, Germany, Asia, Middle east, Brazil, Spain, Africa, Mexico, Italy

TTPs:
Tactics: 1
Technics: 0

IOCs:
File: 37
Hash: 127
Domain: 12
IP: 1
Url: 10

Soft:
Android, Google Play, ndroid; o, ndroid 13, ndroid.ve, roid.vend, id.vendin, ndroid.Cl, appstore

Algorithms:
zip, rc4, aes, md5, base64, cbc

Functions:
getUserHandleForUid, getConfigs, setAdData, createSession

Languages:
kotlin, java

Platforms:
apple