- Bitdefender uncovered a preinstalled Android malware campaign dubbed Midnight Mimosa affecting low-cost smartphones with MediaTek platforms
- The malware grants system-level privileges enabling ad fraud, unauthorized app installation, and device enrollment in residential proxy botnets
- 13 apps on Google Play were found communicating with the same command servers, extending the threat beyond firmware infections
- Most infected devices are located in Mexico followed by France, Italy, and the United States
Bitdefender has uncovered a malware campaign dubbed Midnight Mimosa targeting low-cost Android smartphones built on MediaTek platforms, with malicious code preinstalled at the firmware level across multiple brands. The malware, identified as “com.android.system.lite,” operates with system-level privileges, enabling attackers to install or uninstall apps, grant permissions to accessibility services and SMS, and execute arbitrary code from a remote server, according to Bitdefender’s research.
The scheme primarily generates revenue through ad and click fraud while turning infected devices into residential proxy relay nodes within botnets. The malware disables the Google Play Store before installing payload apps to bypass Play Protect safeguards, then re-enables the store afterward.
Bitdefender discovered 13 apps on Google Play communicating with the same command servers, indicating the campaign extends beyond firmware infections. The preinstalled nature suggests a supply chain compromise, with infrastructure overlaps linked to Android.Phantom, previously documented by Doctor Web as bundled within modded games for click fraud.
The vast majority of infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand. This marks the latest instance of firmware-level backdoors targeting Android devices, following Kaspersky‘s disclosure of the Keenadu malware preinstalled on tablets for ad fraud, as reported by Sophos.
“Preinstalled malware is a different threat class,” Bitdefender stated. “Remediation cannot rely on uninstall. Because the root component ships in the system partition, an affected owner cannot remove it by the normal route.”
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
