Low cost Android smartphones have been found carrying preinstalled malware within device firmware, allowing operators to remotely install applications, perform advertising related fraud activities, and convert infected devices into residential proxy nodes. The activity has been identified by cybersecurity company Bitdefender under the name Midnight Mimosa and primarily affects Android devices built on MediaTek platforms across multiple brands. Researchers said the malware, identified as com.android.system.lite, operates with system level privileges, giving it capabilities beyond typical applications installed by users. The discovery highlights growing concerns around firmware level threats, where malicious components are embedded before devices reach consumers and cannot easily be removed through standard methods.
According to Bitdefender’s analysis, the malware can remotely download and execute additional payloads, install or remove applications, and grant permissions to Android application packages. The malware communicates with external servers to receive configuration instructions before downloading additional components designed for activities such as ad fraud, proxy services, and code execution. Researchers explained that the operators can adjust infected devices based on their requirements, potentially turning thousands of smartphones into parts of large botnet networks. The company noted that the malware itself does not directly perform fraudulent clicks. Instead, monetization activities are carried out through additional applications known as dropper apps, which appear to provide legitimate services while loading advertising components that generate revenue through hidden ad activity. Bitdefender researchers said these dropper applications can display advertisements outside their normal interfaces, including when users are not actively interacting with the applications. The security company identified 13 applications on Google Play that communicated with the same servers controlling the malware infrastructure. These applications offered legitimate features such as weather updates, QR code scanning, messaging recovery, and translation tools, but were also linked to unwanted advertising behavior. The identified applications included Wavrge, App Icon DIY, Audify, QR Pocket, All Deleted Messages Recovery, WeatherGo, CoolWeather, Daily Weather, Lock & Hide, QuickText Extractor, NoteMaster, Tap to Translate, and Tasky. Bitdefender stated that these applications are no longer available for download through Google Play.
A notable behavior observed by researchers was the malware’s ability to disable the Google Play Store application before installing additional payloads and later restore it after execution. Researchers believe this behavior may help bypass security protections such as Play Protect. The investigation also found that some affected devices used firmware signed with certificates linked to Shenzhen Zediel Co., Ltd, a Chinese Android device manufacturer. However, Bitdefender clarified that the certificate ownership does not confirm involvement or awareness of malware deployment, and the investigation identified multiple company names during analysis. The presence of malware within device firmware suggests a possible supply chain compromise, where malicious software enters devices before reaching end users. The majority of identified infected devices were located in Mexico, followed by France, Italy, the United States, Germany, Brazil, Spain, the United Kingdom, Canada, Romania, Poland, and Thailand. Bitdefender observed the campaign across thousands of devices in more than 150 countries over approximately two years. Many affected smartphones appeared to be low cost, white label, or counterfeit devices, including models using names similar to popular Samsung Galaxy smartphones and Apple iPhone products. The researchers also noted similarities with previous firmware based malware campaigns, including Android.Phantom and Keenadu, which were reported in earlier investigations involving ad fraud activities.
Bitdefender emphasized that preinstalled malware represents a different category of security risk because traditional protections assume users can review installations, rely on app store checks, and remove unwanted software. Since firmware level malware operates from the system partition, normal app removal methods may not be effective. Researchers advised that affected devices require firmware level cleanup or advanced methods such as disabling components through Android Debug Bridge (ADB), which may not be practical for most users. The company stated that long term remediation depends on device vendors and marketplaces ensuring stronger security controls throughout the firmware development and distribution process.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
