Thousands of budget Android phone owners worldwide have discovered malware preinstalled on their devices before first use, according to cybersecurity firm Bitdefender.
The malware, dubbed Midnight Mimosa, is embedded in the firmware of low-cost Android phones built on MediaTek chips. Bitdefender identified the highest-volume affected models as the Doogee S200 X and Cubot KINGKONG X, along with counterfeit devices impersonating Samsung and Apple phones.
Victims span more than 150 countries, with the highest concentrations in Mexico, France, Italy, the US, Germany, Brazil, and Spain.
How the Malware Operates
Running with system-level privileges, Midnight Mimosa can silently install and remove applications, grant permissions, and load code from remote servers. The malware cannot be uninstalled because it is integrated into the device firmware before the phone is powered on for the first time.
Researchers identified at least 32 disguised applications deployed by the malware, including fake weather apps, app-lock tools, file managers, icon tools, OCR software, and audio editors. Infected phones can also be converted into residential proxies and incorporated into botnets for activities including DDoS attacks.
Additional Findings
Bitdefender also discovered 13 applications on the Google Play Store carrying the same ad-fraud code associated with the malware.
The firm stated it remains unclear at what point in the supply chain the malware was added to the devices. Bitdefender has not accused Doogee, Cubot, or any other manufacturer of intentionally installing the malware.
