Hidden Malware Infects Cheap Android Phones

Security researchers have uncovered a significant malware operation named Midnight Mimosa, which pre-installs malicious software onto low-cost Android devices before they are even activated by consumers. This hidden malware resides within the device's firmware, granting it privileged access beyond that of ordinary applications. The campaign has impacted thousands of unique devices across more than 150 countries over the past two years, with notable occurrences in Mexico, France, Italy, and the United States.

The primary function of Midnight Mimosa appears to be financial gain through advertising fraud, where it silently installs apps that generate ad revenue without user interaction. Additionally, the malware possesses the capability to turn infected phones into residential proxy servers, potentially routing internet traffic through users' connections to conceal the origin of cybercriminal activities. This sophisticated threat can also temporarily disable the Google Play Store to evade security checks during malicious app installations.

While the malware was found embedded in system software of devices using MediaTek chipsets, and some models like Doogee's S200 X and Cubot's KINGKONG X were identified, the exact point of infection in the manufacturing process remains unclear. The malware can also disguise itself, with some devices reporting counterfeit model identifiers resembling premium Samsung or Apple models. Owners of affected devices face challenges in removal, as standard uninstallations are ineffective, and specialized firmware-level cleanup may be required, making device replacement a potential necessity.