Malware found preinstalled on low-cost Android phones in 150+ countries

• 

  Bitdefender identified a malware campaign called Midnight Mimosa embedded in the firmware of low-cost Android phones.

• 

  The malware gives attackers system-level access to install or remove apps, grant permissions and run remotely supplied code.

• 

  Researchers observed thousands of affected devices in more than 150 countries over approximately two years.

• 

  The campaign uses apps to commit advertising fraud and can turn devices into residential proxies or parts of botnets.

• 

  The malware’s presence in device firmware points to a supply-chain threat, but who introduced it and when remains unclear.

Who

Bitdefender discovered and analyzed the campaign. The people responsible for modifying the firmware are unknown.

What

Midnight Mimosa malware was found preinstalled in low-cost Android phone firmware, with system-level privileges.

When

Researchers observed affected devices over approximately two years. The sources do not state when the campaign began.

Where

On low-cost Android devices using MediaTek chipsets, in more than 150 countries.

Why

The malware is used for advertising fraud and can turn devices into residential proxies or parts of botnets. The sources do not state the operators’ full motives.

This story does not have two clearly opposing sides.