Some low-cost Android smartphones have reached customers with Midnight Mimosa malware embedded in their firmware. The malicious software can silently install applications, generate fraudulent advertising activity and turn infected phones into residential proxies.
Bitdefender researchers identified thousands of affected devices across more than 150 countries over roughly two years. Mexico, France, Italy, the United States, Germany, Brazil and Spain recorded the highest victim counts.
Researchers suspect supply-chain tampering. However, they have not established who modified the firmware or where that interference occurred.
Malicious Software Arrives With System Privileges
The campaign affects certain low-cost Android devices using MediaTek chipsets. Its malicious components sit inside the system partition and operate with elevated privileges.
Consequently, they can install or remove applications, grant sensitive permissions and execute downloaded code without the owner’s involvement.
The packages also use names resembling legitimate Android components, including com.android.system.lite, com.android.sys.prot and com.android.sys.gmsprot.
Because these signed applications run as system components, Android’s standard uninstall process cannot remove them.
Bitdefender began investigating after its detection technology flagged a system application that secretly installed and deleted other apps. Further analysis revealed a wider framework that retrieves additional modules from command-and-control servers.
Device Reports Point to Firmware Problems
Researchers found infections on devices bearing model names associated with legitimate manufacturers, including the Doogee S200 X and Cubot KINGKONG X. They also identified phones impersonating Samsung and Apple products.
Meanwhile, owners discussing suspicious behavior on an Android community forum described applications that returned after removal.
One Doogee Fire 3 Max owner reported that an official firmware update introduced the infection. According to that account, restoring older firmware removed it, while reinstalling the update brought it back.
Some users said subsequent manufacturer updates resolved their infections. However, the manufacturers have not publicly explained how the malicious components entered the affected firmware.
Researchers also found firmware signed with certificates associated with Shenzhen Zediel. That connection does not establish the manufacturer’s involvement in the campaign.
Ordinary-Looking Apps Generate Advertising Fraud
The Midnight Mimosa malware framework distributed approximately 32 applications disguised as useful tools. These included weather apps, file managers, app lockers, optical character recognition tools and audio editors.
Although the applications appear functional, some load advertisements in invisible windows or interact with ads automatically.
As a result, the operators can generate fraudulent impressions and clicks without the phone owner’s participation.
The malware also attempts to evade security checks. Before installing additional software, it temporarily disables the Google Play Store application.
According to Bitdefender, this behavior aims to prevent Google Play Protect from detecting the installation. Afterwards, the malware restores the Play Store to reduce visible signs of interference.
Some variants also alter installer records, making applications appear to originate from Google Play despite their installation by the malware.
Proxy Module Can Route Traffic Through Infected Phones
Researchers discovered a TCP proxy component inside an application posing as an app locker, named com.mobile.applock.en.
The component registers infected phones with a remote server. It can then receive instructions to connect to specified hosts and relay traffic through the device.
This capability could conceal the origin of malicious activity behind a phone owner’s internet connection. It could also provide access to systems reachable from the infected handset.
However, researchers distinguished that capability from confirmed use. They verified that the command infrastructure accepted registrations, but their test device received no relay destinations.
Therefore, their testing did not confirm active traffic forwarding.
Related Apps Also Appeared on Google Play
Separately, Bitdefender identified 13 Google Play applications containing the same advertising fraud code and contacting known campaign infrastructure.
These apps lacked the system privileges needed to install other software silently. Nevertheless, they could display advertisements outside their own interfaces, including while owners were not using their phones.
Researchers linked the apps to 13 signing certificates and at least two developer accounts.
For devices with infected firmware, ordinary app removal does not resolve the underlying problem. Bitdefender says remediation requires firmware-level cleanup or disabling the malicious component through Android Debug Bridge, a process that can challenge less technical users.
0 responses to “Midnight Mimosa Malware Found Preinstalled on Budget Android Phones”