Preinstalled Android Malware Campaign Reaches Devices in More Than 150 Countries
Summary
Bitdefender found the Midnight Mimosa malware preinstalled in some budget Android devices, where it can operate with system-level privileges for ad fraud and botnet activity. Researchers also found related code in 13 Google Play apps.
Key points
- Bitdefender’s Midnight Mimosa campaign targets low-cost Android devices, with malware preinstalled in firmware as a persistent system app.
- Over two years, Bitdefender observed thousands of affected devices across more than 150 countries; Mexico and France led the reported distribution.
- System-level privileges let operators remotely install or remove apps, grant permissions, and load code, potentially adding devices to botnets.
- The campaign focuses on ad and click fraud and also involves proxy-network abuse and remote payload management.
- Researchers found the same malware family markers in 13 Google Play apps published under two developer accounts.
- The malware has been observed disabling Google Play Store during additional payload installation, then re-enabling it, potentially to evade Play Protect.
Article Details
- Event Type
- Supply-chain malware campaign involving malware preinstalled in Android device firmware and related apps distributed through Google Play.
- Impact
- Over two years, Bitdefender observed thousands of affected devices in more than 150 countries. The malware can operate with system-level privileges to install or remove apps, grant permissions, load remotely supplied code, commit ad and click fraud, and add devices to botnets. The source reports no estimate of monetary gains.
Products
AndroidThere is a large global market for low-cost Android devices.Google PlayBitdefender also found 13 apps on Google Play with separate signing certificates under two developer accounts and containing the same Midnight Mimosa ad-fraud code.Google Play Protect“Beyond suppressing the install prompt, the plugins blind Google Play Protect for the duration of the install,” note the researchers.
Countries
Brazilsingle country or region dominates distribution. Mexico and France lead, followed by Italy, US, Germany, Brazil and Spain. Regionally, Western Europe and the Americas stand out. The report gives no indication of theFrancedevices in more than 150 countries. No single country or region dominates distribution. Mexico and France lead, followed by Italy, US, Germany, Brazil and Spain. Regionally, Western Europe and the Americas standGermanyNo single country or region dominates distribution. Mexico and France lead, followed by Italy, US, Germany, Brazil and Spain. Regionally, Western Europe and the Americas stand out. The report gives no indicationItaly150 countries. No single country or region dominates distribution. Mexico and France lead, followed by Italy, US, Germany, Brazil and Spain. Regionally, Western Europe and the Americas stand out. The report gives noMexicounique affected devices in more than 150 countries. No single country or region dominates distribution. Mexico and France lead, followed by Italy, US, Germany, Brazil and Spain. Regionally, Western Europe and theSpainor region dominates distribution. Mexico and France lead, followed by Italy, US, Germany, Brazil and Spain. Regionally, Western Europe and the Americas stand out. The report gives no indication of the actualUnited Statescountries. No single country or region dominates distribution. Mexico and France lead, followed by Italy, US, Germany, Brazil and Spain. Regionally, Western Europe and the Americas stand out. The report gives no