Low-cost Android smartphones have been identified with preinstalled malware embedded in their firmware, enabling malicious actors to install apps secretly, commit ad fraud, and convert devices into residential proxies. This activity, known as Midnight Mimosa, targets Android devices running on MediaTek platforms across various brands, as tracked by cybersecurity firm Bitdefender. The malware, operating under the name 'com.android.system.lite', possesses system-level privileges, allowing it to manage apps dynamically, grant itself additional permissions, and execute arbitrary code remotely.
The malware retrieves configurations from an external server to download and execute payloads that facilitate ad fraud and the silent installation or removal of partner apps. It further contains proxyware and code execution capabilities, turning compromised devices into nodes in large botnets. The primary goal appears to be revenue generation through ad and click fraud, as well as collecting device data and installed app information.
Bitdefender has identified 13 apps on Google Play that interact with the same command and control servers as the malware, indicating that the campaign extends beyond preinstalled firmware. Although these apps provide genuine functions, like weather updates or QR-code scanning, they also display ads outside their intended context. Notably, the malware disables the Google Play Store app to bypass Play Protect, re-enabling it after executing its payload.
The malware is found on devices with firmware signed by Shenzhen Zediel Co., Ltd, a Chinese manufacturer. However, the company's involvement remains uncertain. This situation highlights a potential supply chain compromise, with the malware showing infrastructure overlaps with Android.Phantom, a threat known for click fraud. The campaign affects thousands of devices worldwide, predominantly in Mexico, but also in France, Italy, the U.S., and other countries. Many affected phones are low-cost or counterfeit models mimicking popular brands.
This kind of firmware-level threat is not new; similar issues have been previously identified by other cybersecurity firms. Bitdefender emphasizes that preinstalled malware poses unique challenges, as traditional user-facing defenses are ineffective. Remediation requires firmware-level intervention, something that is often not feasible for the average user. Responsibility lies with vendors and marketplaces to address and prevent such vulnerabilities.
