Malware Found Preinstalled on Cheap Android Phones, Security Firm Reports

Security researchers have identified a malware campaign, dubbed "Midnight Mimosa," that infects certain low-cost Android devices before they are even activated by their owners. The malicious software is embedded within the phone's firmware, granting attackers elevated access that standard applications cannot achieve. This issue has also been found on related malicious apps distributed through the Google Play Store and has reached devices in the United States.

Factory-Installed Malware on Android Devices

Unlike typical security advice focusing on cautious app downloads, Midnight Mimosa bypasses these precautions by arriving with the device itself. According to research from Bitdefender, the malware was discovered on budget Android phones utilizing MediaTek chipsets. The malicious applications are integrated into the system software, allowing them to operate with system-level privileges. These privileges enable the malware to install or remove applications without user permission and grant sensitive access to other software. It can also download and execute new code remotely. The malware often disguises itself with package names that appear to be legitimate system components, such as "com.android.system.lite," making it difficult for users to detect. Because the malware resides in the system partition, a standard uninstall process cannot remove the core infection.

Global Reach and Counterfeit Devices

Bitdefender observed the Midnight Mimosa campaign affecting thousands of unique devices across more than 150 countries over approximately two years. Mexico, France, and Italy reported the highest numbers, followed by the United States, Germany, Brazil, and Spain. Researchers noted specific device models associated with the campaign, including Doogee's S200 X and Cubot's KINGKONG X, though they cautioned that not all devices of these models are necessarily affected. Some devices in the campaign have also used misleading or counterfeit model identifiers, making identification difficult based on the reported name alone. Additionally, some counterfeit devices have mimicked the model identifiers of premium Samsung or Apple iPhones, suggesting they may contain inexpensive Android hardware with modified software.

The investigation also identified firmware signed with certificates linked to Shenzhen Zediel, a Chinese device manufacturer. However, Bitdefender stressed that this finding does not confirm the company's involvement in creating the malware or knowledge of its presence. The exact point at which the malicious code entered the manufacturing and distribution chain remains unknown.

Functionality of the Hidden Malware

The primary goal of Midnight Mimosa appears to be generating revenue for its operators through advertising fraud. The firmware malware silently installs applications disguised as common utilities like weather tools or app lockers. These applications can display advertisements in hidden windows or generate clicks without user interaction, leading to fraudulent charges for advertisers. Bitdefender identified at least 32 unique disguised applications involved in this operation. The malware can also repeatedly install and uninstall these apps, making them harder to notice.

Beyond advertising fraud, researchers found that the malware can transform infected phones into residential proxy servers. This allows attackers to route internet traffic through a user's connection, masking the origin of online activity. While Bitdefender confirmed the capability to turn phones into proxy servers, their testing did not demonstrate active traffic relay. The potential for such misuse, however, remains a significant concern.

One concerning tactic employed by Midnight Mimosa is the temporary disabling of the Google Play Store app before installing certain malicious applications. This appears to be an attempt to evade detection by Google Play Protect. Once the installation is complete, the store is re-enabled, potentially reducing the likelihood of the user noticing any unusual activity. Some versions of the malware also manipulate Android's installer records to make it seem as though apps were installed from Google Play, even when they were deployed directly by the malware.

Bitdefender identified 13 specific applications associated with the campaign: Wavrge, App Icon DIY, Audify, QR Pocket, All Deleted Messages Recovery, WeatherGo, CoolWeather, Daily Weather, Lock & Hide, QuickText Extractor, NoteMaster, Tap to Translate, and Tasky. These apps offered various functionalities but could also generate unwanted advertising activity. None of these apps were available for download on Google Play at the time of Bitdefender's checks, though it remains unclear if Google removed them or if the developers withdrew them.

User Reports and Protection Measures

Complaints on forums from owners of Doogee and Cubot smartphones have corroborated these findings, with users reporting the reappearance of suspicious system applications after removal attempts. Some users even reported that official firmware updates introduced the infection, while reverting to older versions resolved the issue. This indicates a complex situation where even firmware updates could potentially reintroduce malware.

To protect Android phone users, security experts recommend several precautions. These include buying devices from reputable sellers and verifying phone models against official manufacturer information, especially for unusually inexpensive smartphones advertised as premium models. Checking if an Android phone is certified by Google Play Protect can indicate adherence to compatibility standards, though it doesn't guarantee the absence of firmware malware. Keeping Google Play Protect enabled and utilizing strong antivirus software are additional layers of defense. Users should also regularly review installed applications for unfamiliar software and scrutinize the permissions they request, particularly sensitive ones like SMS or accessibility access. Monitoring for unusual phone behavior, such as unexplained data usage or unexpected ads, is also advised. When dealing with potential firmware compromise, caution is advised regarding factory resets, as they may not remove deeply embedded system malware. In such cases, contacting the manufacturer or considering device replacement might be the safest options. If a compromise is suspected, users should immediately change passwords on important accounts and enable multifactor authentication using a separate, trusted device.