Preinstalled malware found on low-cost Android phones in more than 150 countries

• 

  Bitdefender found preinstalled malware on low-cost Android phones from different brands that use MediaTek platforms.

• 

  The malware is built into device firmware, is present before a phone is first switched on and cannot be uninstalled.

• 

  The campaign, named Midnight Mimosa, was observed on thousands of devices in more than 150 countries.

• 

  Bitdefender says the operators use infected phones for ad and click fraud, data collection and residential-proxy relays.

• 

  The malware has system-level privileges that let it install and remove apps, grant permissions and load code remotely.

Who

Bitdefender researchers identified the malware campaign. The operators’ identities are not stated.

What

Midnight Mimosa is malware preinstalled in the firmware of low-cost Android phones and cannot be uninstalled.

When

It is present before owners switch on the phones for the first time. The sources do not state when the campaign began.

Where

On affected phones in more than 150 countries.

Why

Bitdefender says the campaign is likely designed to generate revenue through ad and click fraud, data collection and proxy services.

This story does not have two clearly opposing sides.