Firmware Malware on Low-Cost Android Phones Creates Proxy Botnets
Bitdefender tracks Midnight Mimosa in Android firmware
Bitdefender has identified malicious software preinstalled in the firmware of low-cost Android smartphones, allowing operators to covertly add applications, carry out advertising fraud and turn affected handsets into residential proxy relays. The campaign, named Midnight Mimosa, targets Android devices built on MediaTek platforms across several brands.
The core component is identified as com.android.system.lite. Running with system-level privileges, it can install or uninstall applications, assign permissions to accessibility services, notifications and SMS, and load code supplied remotely by its operators. Bitdefender said these capabilities could allow the operators to tune individual devices for botnet activity.
The component retrieves a remote configuration from an external server before downloading and executing further payloads. Those payloads are designed for ad fraud and for the silent installation or removal of partner applications. The added apps contain proxyware, ad-fraud and code-execution features, while the system component can grant permissions to any Android application package.
Ad fraud payloads and Play Store connections
Bitdefender said Midnight Mimosa itself does not perform fraudulent clicks. Instead, dropper apps posing as benign utilities load genuine advertisements through a legitimate advertising SDK. Their stated objective is to place an invisible window over apps and register ads that are displayed.
The researchers found 13 apps on Google Play that communicate with the same servers used to control the malware. This indicates that the activity extends beyond compromised firmware. A notable evasion step is disabling the Google Play Store before installing a payload, likely to avoid Play Protect safeguards, then enabling the store again after the payload has run.
Devices carrying the malware were observed with firmware signed using certificates attributed to Shenzhen Zediel Co., Ltd, a Chinese Android device manufacturer. Bitdefender said it was not clear whether the certificate owner was involved in, or aware of, the malware deployment. Its investigation also identified other company names.
Supply-chain exposure is difficult for owners to fix
The preinstalled component points to a device supply-chain compromise. Bitdefender also reported infrastructure overlaps with Android.Phantom, malware Doctor Web documented as bundled with modified games and popular applications for click fraud.
Most infected devices are in Mexico, followed by France, Italy, the United States, Germany, Brazil, Spain, the United Kingdom, Canada, Romania, Poland and Thailand. Bitdefender stressed that firmware-level malware differs from a conventional unwanted app: prompts, store review, Play Protect and ordinary uninstall mechanisms assume that the device owner controls installation.
Because the root component sits in the system partition, owners cannot remove it through normal uninstall processes. Bitdefender said effective cleanup requires firmware-level remediation or disabling the component through ADB, neither of which is practical for many consumers. For businesses procuring Android devices, the implication is to assess vendor and firmware provenance, support for remediation and marketplace controls before devices are issued or deployed.