Bitdefender finds preinstalled Android malware on low-cost phones

Bitdefender said it had tracked the activity as Midnight Mimosa. It said the preinstalled package, com.android.system.lite, ran with system privileges on Android devices built on MediaTek platforms and could add or remove disguised apps, request extra permissions and run code supplied by remote operators.

The company said the malware fetched configuration from an external server before downloading further payloads. It said those payloads were used for ad fraud and for silently installing or removing partner apps, and that the malware could disable Google Play Store before a payload was installed and then turn it back on.

Bitdefender said it had identified 13 Google Play apps that connected to the same servers as the firmware-based malware. It said the apps offered functions such as weather data, QR-code scanning and message recovery, but also displayed ads outside the app interface; none were available for download at the time of writing.

The company said most affected devices were in Mexico and that it had seen the campaign on thousands of devices across more than 150 countries over about two years. It said some firmware was signed with certificates attributed to Shenzhen Zediel Co., Ltd, but it had not established whether that company was involved or aware, and it said some counterfeit devices had borrowed the names of Samsung Galaxy phones and Apple iPhones.