Pre-installed Malware Discovered on Android Smartphones

Security experts from Bitdefender have uncovered a new wave of attacks known as Midnight Mimosa. This affects low-cost Android smartphones that are shipped with pre-installed malware. The malware is integrated into the firmware of the devices, meaning that buyers receive a new device with the malicious software already installed. The malware has system privileges, allowing attackers to install apps unnoticed, commit ad fraud, and turn devices into private proxies. Bitdefender identified around 32 applications that were distributed through the malware framework.

These apps are disguised as everyday applications, including weather apps, file managers, and audio editors. A central issue is that attackers can execute downloaded code remotely without user intervention. Researchers suspect that the malware was injected at some point in the supply chain of the devices. However, the exact origin of the malicious code remains unclear. The security researchers found firmware signed with certificates associated with the Chinese device manufacturer Shenzhen Zediel.

However, Bitdefender emphasizes that this technical attribution does not prove that Shenzhen Zediel authored or distributed the malware or was aware of it. The malware particularly affects low-cost Android devices with MediaTek chipsets. According to reports from Bleepingcomputer, affected models include devices with model names associated with reputable manufacturers, such as the Doogee S200 X and the Cubot KINGKONG X. Affected users report suspicious applications that reinstall themselves after being uninstalled. One owner of a Doogee Fire 3 Max recounted that an official firmware update infected the device with the malware.

After restoring an older firmware version, the malware disappeared, but reappeared upon reinstalling the update. Some manufacturers have released firmware updates intended to resolve the issue. However, they have not publicly explained how the malware entered the affected firmware. The uncertainty regarding the origin of the malware persists, complicating the situation for users. The campaign has affected thousands of devices over a period of about two years, with most victims reported in Mexico, France, Italy, the United States, Germany, Brazil, and Spain.

The spread of the malware highlights how vulnerable even newly purchased devices can be. The security situation for Android users remains tense, as the malware is deeply integrated into the firmware. Experts advise consumers to pay attention to the origin and security standards of devices when purchasing smartphones. The discovery of this malware raises questions about security across the industry. Bitdefender has documented the affected models and malware variants to warn users.

Researchers are working to uncover further details about the attackers and the methods used to inject the malware. The exact number of affected devices is currently unknown. Security researchers recommend regularly performing firmware updates and immediately uninstalling suspicious applications. Users should also ensure they only download apps from trusted sources to minimize the risk of infection. The malware campaign has already led to an increase in security alerts, and experts are calling for enhanced monitoring of supply chains in the smartphone industry.

The discovery of this malware could have long-term implications for security standards in the industry. Bitdefender has classified the malware as a serious threat and warns of the potential consequences for users. The security situation will continue to be monitored to track further developments. Bitdefender researchers have identified the malware in devices sold in various countries and are working to inform affected users. The exact number of affected devices and the spread of the malware are still under investigation.

The security situation remains tense, and users are urged to stay vigilant. The malware campaign has already affected thousands of devices, and researchers are continuing their investigations to better understand the background and spread of the malicious software. Bitdefender's security researchers have classified the malware as a serious threat and warn of the potential consequences for users.

The security situation remains tense, and users are urged to stay vigilant.