Cybersecurity
Android phones ship with proxy malware
Bitdefender said Midnight Mimosa was built into inexpensive Android phone firmware, reached thousands of devices in more than 150 countries, and let infected handsets install apps, run ad fraud and relay traffic.
- Bitdefender said Midnight Mimosa was present in the firmware of low-cost Android phones built on MediaTek chipsets.
- The company said the campaign touched thousands of devices in more than 150 countries over roughly two years, with the heaviest concentration in Mexico, France, Italy, the US, Germany, Brazil and Spain.
- Bitdefender said the code could add and remove apps, grant permissions, execute downloaded code, and support ad-fraud and proxy activity.
- Some Cubot and Doogee owners said suspicious apps kept coming back after removal, and one Doogee Fire 3 Max owner said an official firmware update caused the infection.
- Bitdefender said it found 13 Google Play Store apps with the same ad-fraud code and firmware signed with certificates linked to Shenzhen Zediel, but it said the company’s part was unclear.
Bitdefender said it had found Midnight Mimosa on low-priced Android handsets built around MediaTek chipsets. It said the malicious code had been added somewhere in the supply chain, but it could not say who changed the firmware or at which point.
The researchers said their App Anomaly Detection tool first picked up com.android.system.lite, a system app that installed and removed other apps without prompting. They said the wider framework fetched extra modules from command servers and spread about 32 apps, some posing as weather tools, file managers, app lockers, OCR software and audio editors.
Bitdefender said the apps drove ad fraud by opening hidden windows and interacting with adverts automatically. It also said the malware switched off com.android.vending before installation to avoid Google Play Protect, then turned it back on afterwards.
The company said com.mobile.applock.en carried a TCP proxy module that enrolled infected phones with a remote server. Bitdefender said the proxy infrastructure was live and taking registrations, but its test handset was not given any relay work.
Owners of Cubot and Doogee phones reported apps that reappeared after deletion, and one Doogee Fire 3 Max owner said an official update caused the infection and an older build cleared it. Bitdefender also said 13 Google Play Store apps shared the same ad-fraud code, were signed with 13 certificates and used at least two developer accounts, fivedev and CPS Developer; it said firmware signed with certificates linked to Shenzhen Zediel was also found, while the company’s role remained uncertain. It said a forum-reported package, com.android.non.szcz, belonged to the same family, and removing the infection required firmware-level cleaning or Android Debug Bridge use.
Named in this story
Companies
- Bitdefender
- the company whose researchers investigated the campaign
- MediaTek
- the chipmaker whose chipsets were used in the affected phones
- Samsung
- a brand some fake devices impersonated
- Apple
- a brand some fake devices impersonated
- Shenzhen Zediel
- the company whose certificates signed some firmware
Organisations
- fivedev
- one developer account used for the Play Store apps
- CPS Developer
- another developer account used for the Play Store apps
Products and systems
- Midnight Mimosa
- the malware campaign embedded in firmware
- Doogee S200 X
- one phone model found with preinstalled malware
- Cubot KINGKONG X
- another phone model found with preinstalled malware
- App Anomaly Detection
- the detection tool that first flagged a suspicious system app
- com.android.system.lite
- the system app Bitdefender first flagged
- com.android.vending
- the Play Store package the malware disabled during installs
- Google Play Protect
- the protection service the malware tried to evade
- com.mobile.applock.en
- the disguised app that contained the proxy module
- Google Play Store
- the store that carried apps linked to the same code
- com.android.non.szcz
- the forum-reported package Bitdefender tied to the same family
- Android Debug Bridge
- the tool Bitdefender said could help remove the infection
- Doogee Fire 3 Max
- the phone model whose owner said an update infected it
How the source tells it
The piece stayed in a neutral incident-reporting register, with the scale claims attributed to Bitdefender rather than used for drama.
No emotive framing was found in the original.