Pre-installed Malware Discovered on Android Smartphones

Security experts from Bitdefender have discovered a new wave of attacks known as Midnight Mimosa. This affects low-cost Android smartphones that are shipped with pre-installed malware. The malware is integrated directly into the firmware of the devices, meaning that buyers receive a new smartphone with malware already installed. The malware has system privileges, allowing attackers to install apps unnoticed, commit ad fraud, and turn the devices into private proxies. Bitdefender identified around 32 applications that were distributed through the malware framework.

These applications disguised themselves as useful tools such as weather apps, file managers, and audio editors. A central issue is that attackers can execute downloaded code remotely without user intervention. The security researchers suspect that the malware was injected at some point in the supply chain of the devices. So far, it is unclear who is behind the attack and at which point the malicious code entered the firmware. The researchers found firmware signed with certificates associated with the Chinese device manufacturer Shenzhen Zediel.

However, Bitdefender emphasizes that this technical attribution does not prove that Shenzhen Zediel authored or distributed the malware or was aware of it. The malware particularly affects low-cost Android devices with MediaTek chipsets. According to reports from Bleepingcomputer, among the affected models are devices with model names associated with reputable manufacturers, such as the Doogee S200 X and the Cubot KINGKONG X. Affected users of Cubot and Doogee smartphones report suspicious applications that reinstall themselves after being uninstalled. One owner of a Doogee Fire 3 Max reported that an official firmware update infected the device with malware.

After restoring an older firmware version, the malware disappeared, but reappeared upon reinstalling the update. Some users indicated that the manufacturers had released firmware updates that resolved the issue. However, the manufacturers have not publicly explained how the malware entered the affected firmware. This leaves many questions unanswered, particularly regarding the security of the devices and the responsibility of the manufacturers. The campaign has affected thousands of devices over a period of about two years in more than 150 countries, with most victims reported in Mexico, France, Italy, the United States, Germany, Brazil, and Spain.

The discovery of this malware raises serious concerns about the security of Android devices, especially in low-cost models. The security situation remains tense as researchers continue to seek solutions to remove the malware and secure the affected devices. The exact number of affected devices in Germany is currently unknown, but the threat of pre-installed malware is a growing problem in the industry. Bitdefender's security researchers have classified the situation as alarming and advise users to be particularly cautious. Users should regularly check their installed applications and obtain firmware updates from trusted sources.

Malware is an example of the increasing challenges associated with mobile device security. The discovery of this threat could have far-reaching implications for manufacturers and consumers who rely on the security of their devices. Bitdefender has documented the affected models and the associated malware in a detailed analysis. The researchers are working to gather more information about the attackers and the methods used to spread the malware.

The security situation will continue to be monitored, and the researchers plan to publish their findings in the coming weeks to inform the public about the risks. The malware campaign has already affected thousands of devices, and security researchers warn of the potential dangers posed by such pre-installed applications. The discovery of the malware and the associated risks highlight the need for consumers to be informed about manufacturers' security practices and to remain vigilant. Bitdefender researchers have identified the malware in firmware versions that have been on the market in the last two years.