Preinstalled Android Malware Turns Low-Cost Phones Into Residential Proxies
Summary
Bitdefender says the Midnight Mimosa malware is preinstalled in firmware on some MediaTek-based Android phones, enabling covert app installation, ad fraud and residential-proxy use. Removing it may require firmware-level cleanup.
Key points
- The malware, tracked as Midnight Mimosa, was found in firmware on low-cost Android devices built on MediaTek platforms across several brands.
- Its system-level privileges let operators install or remove apps, grant permissions and execute remotely supplied code.
- Payloads can enable ad fraud and turn infected phones into residential-proxy nodes; dropper apps, rather than the malware itself, drive fraudulent ad activity.
- Bitdefender found 13 Google Play apps communicating with the same control servers, suggesting the activity extends beyond firmware-preinstalled malware.
- The malware temporarily disables Google Play Store before installing a payload, apparently to bypass Play Protect safeguards.
- Some affected firmware was signed with certificates attributed to Shenzhen Zediel, but Bitdefender said it is unclear whether the company knew of or was involved in the deployment.
- Because the malware resides in the system partition, ordinary uninstalling may not remove it; remediation may require firmware cleanup or disabling the component over ADB.
Article Details
- Event Type
- Preinstalled Android firmware malware and suspected device supply-chain compromise
- Impact
- The malware can covertly install and remove apps, load remote code, facilitate ad and click fraud, collect device and installed-app information, and turn infected phones into residential-proxy relay nodes. Because it resides in the system partition, ordinary uninstalling is not sufficient; remediation requires firmware-level cleanup or disabling the component over ADB. Bitdefender reported infected devices across multiple countries and found 13 Google Play apps communicating with the same servers, but the article provides no specific IOC values.
Malware
Android.Phantomof the device supply chain, with Bitdefender highlighting some level of infrastructure overlaps with Android.Phantom, which was documented by Doctor Web as bundled within modded games and popular apps to conduct clickcom.android.system.liteThe preinstalled malware ("com.android.system.lite") runs with system-level privileges, which make it possible to install or uninstall apps, grant itself additional permissions to accessibility services, notifications,Keenadutargeting Android devices. Late last year, Kaspersky disclosed details of another malware codenamed Keenadu that was discovered preinstalled on certain models of tablets running Android to primarily enable ad
Vendors
GoogleIn all, Bitdefender said it discovered 13 apps on Google Play that communicate with the same servers that control the malware, indicating the campaign is not limited to preinstalled firmware -MediaTekThe activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa.Shenzhen Zediel Co., Ltdthe malware has been detected on devices with firmware signed using certificates attributed to Shenzhen Zediel Co., Ltd, a Chinese Android device manufacturer. However, it's unclear at this stage if the certificate
Products
AndroidLow-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies.Google Play StoreA notable aspect of the malware is that it disables the Google Play Store app prior to installing a payload app, likely in an attempt to bypass Play Protect safeguards, and then re-enable the app after the payload isPlay Protectdisables the Google Play Store app prior to installing a payload app, likely in an attempt to bypass Play Protect safeguards, and then re-enable the app after the payload is run.
Countries
BrazilThe vast majority of the infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand.CanadaThe vast majority of the infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand.FranceThe vast majority of the infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand.GermanyThe vast majority of the infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand.ItalyThe vast majority of the infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand.MexicoThe vast majority of the infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand.PolandThe vast majority of the infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand.RomaniaThe vast majority of the infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand.SpainThe vast majority of the infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand.ThailandThe vast majority of the infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand.United KingdomUnited States