Low-Cost Android Phones Found Shipping With Preinstalled Proxy Malware
Bitdefender uncovered malware in low-cost Android phones that turns them into residential proxies. The campaign, named Midnight Mimosa, affects MediaTek-based devices from multiple brands.
TL;DR
- Malware found in low-cost Android phones at firmware level.
- Devices turned into residential proxies without user knowledge.
- Campaign dubbed 'Midnight Mimosa' by Bitdefender researchers.
- Targets MediaTek-based Android devices across various brands.
- Enables app installation, ad fraud, and covert network routing.
A recent discovery by Bitdefender has revealed that certain low-cost Android smartphones are being sold with malicious software embedded directly in their firmware. This malware enables attackers to covertly install applications, run ad fraud operations, and transform the devices into residential proxy nodes.
Dubbed "Midnight Mimosa" by researchers, the campaign primarily impacts Android devices built on MediaTek chipsets and spans multiple lesser-known brands. These compromised devices pose significant risks to both individual users and enterprise networks due to their ability to route traffic invisibly through infected endpoints.
How the Malware Operates
- The malware resides within the device's firmware, making it persistent across reboots and factory resets.
- It can silently install unwanted apps without user consent or awareness.
- Infected devices are used to generate fraudulent ad impressions and clicks.
- Attackers leverage these phones as residential proxies to mask malicious online activities.
- Traffic routed through these proxies appears to originate from legitimate home internet connections.
Impact and Mitigation
- Organizations should vet hardware suppliers and avoid ultra-low-cost device vendors.
- Enterprises using BYOD policies must implement strict mobile device management controls.
- Users should monitor data usage patterns for unexpected spikes indicating proxy activity.
- Security teams should consider network traffic analysis tools to detect anomalous outbound connections.
- Firmware-level threats like Midnight Mimosa underscore the need for supply chain security assessments.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.