Midnight Mimosa is downloaded by Triada in the firmware of some devices, rather than being directly present

enelsonmoore

Hi, everyone,

I'm a professional programmer and hobbyist security researcher. In the process of analyzing a Triada infection on my own phone (posted separately), I discovered that on at least two devices (the Maxwest Nitro A65 and the Cubot KingKong X) affected by Midnight Mimosa, the malicious apps are not present in the firmware but instead downloaded by Triada embedded in libandroid_runtime.so.

See my analysis here: https://ethannelson-moore.github.io/blog/2026/10/25/maxwest-nitro-a65-triada/

Also, would you be able to post a full list of devices affected by Midnight Mimosa so users can tell if they are affected? The graph in the article doesn't have brands and doesn't list all devices. If possible, it should include ro.product.{device,model,brand,manufacturer} and ro.build.fingerprint. If ro.build.fingerprint doesn't match the others, omit it - knockoff devices often use stolen fingerprints to fake Google certification.

I have a couple of corrections to make to your Midnight Mimosa article regarding affected devices:

• The Magic 15 MAX is not from Honor but AllCall; the Honor Magic 15 MAX doesn't exist.
• "Note 18 Ultra" is likely not a knockoff device but the Ulefone Note 18 Ultra on Google's supported device list: https://storage.googleapis.com/play_public/supported_devices.html