Midnight Mimosa: Malware Lurks in Budget Androids

A dangerous malware strain, identified as Midnight Mimosa, has been found preinstalled on counterfeit and budget Android phones. This malware was discovered on thousands of unique devices spanning over 150 countries, with Mexico, France, Italy, the US, and Germany reporting the highest numbers. Many affected models were counterfeit, falsely using names like "i17 Pro Max" or "S25 Ultra."

Bitdefender's investigation revealed the malware embedded as a seemingly dormant "android.system.lite" component. Once active, it could install and remove various disguised applications, including fake app lockers and file managers. This deep system access allows operators to potentially make devices part of large botnets.

The malware's operators may be engaging in click fraud by artificially generating ad views. Alternatively, compromised phones could be used as residential proxy services for botnets, allowing cybercriminals to mask their online activity. The malware was signed by a Chinese developer, though their direct involvement remains unclear, with possibilities of other supply chain actors being responsible.

For owners of affected phones, removing the malware is not straightforward. Bitdefender suggests that a firmware-level cleanup or disabling the component via ADB is necessary, neither of which is practical for most users. The ultimate solution lies with device vendors and marketplaces to address the firmware issues before sale.