MidnightDat
MidnightDat is an Android dropper malware family used in a large-scale malware campaign targeting users in Uzbekistan. It has been observed delivering the Wonderland SMS stealer and is described as one of two dropper families designed to conceal the primary encrypted payload, alongside the AES-based RoundRift. According to the provided reporting, MidnightDat was first seen on August 27, 2025.
Infection typically begins with a malicious APK masquerading as a legitimate application, including fake Google Play Store apps, popular Uzbek apps, or lures such as videos and invitations. The broader campaign relies heavily on Telegram-based social engineering, sideloaded APKs, fake websites, and abuse of stolen Telegram accounts to propagate malware to victims' contacts. Group-IB observed MidnightDat in the Uzbekistan-focused wave that began in October 2025.
The dropper is used to evade detection by appearing clean or harmless while embedding the stealer deeper inside the application package. The associated droppers can pass many standard security checks, complicating early detection. The malware in this campaign uses heavy obfuscation, deliberately confusing code, and anti-analysis functionality intended to hinder sandboxing and researcher analysis. Attackers also regularly rotate infrastructure domains and malicious package names.
MidnightDat is associated in the reporting with campaigns involving the Wonderland SMS stealer, which has been attributed to the financially motivated TrickyWonders group. The broader activity has targeted Android users in Uzbekistan, especially Telegram users, with the objective of stealing SMS messages, one-time passwords, credentials, and ultimately money from victims' bank cards. No MidnightDat-specific indicators of compromise are provided in the content beyond its name, role as a dropper, first-seen date, and its use in these Uzbekistan-focused Android malware operations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"The attackers were observed using the SMS stealer Wonderland, dropper malware MidnightDat, the AES-based dropper RoundRift..."
"The attackers were observed using the SMS stealer Wonderland, dropper malware MidnightDat, the AES-based dropper RoundRift..."
"The attackers were observed using the SMS stealer Wonderland, dropper malware MidnightDat, the AES-based dropper RoundRift..."
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
MidnightDat is an Android dropper app used to deliver the Wonderland SMS stealer payload. It masquerades as legitimate applications to trick users into installing it and bypassing Android security controls.
Dropper malware family used to conceal and deliver the Wonderland payload on Android devices.
Android dropper used to deliver embedded stealer payloads while appearing clean/harmless to evade early detection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.