[CLSTR]
< Back to all clusters
[TECHNOLOGY] · Mexico, France, Italy, United States, Germany · 12 sources

started · updated

Part of situation: Midnight Mimosa Android firmware malware (2 clusters)

Midnight Mimosa malware preinstalled in budget Android smartphone firmware

Midnight Mimosa Android malware firmware infection ad fraud botnets

Security researchers at Bitdefender have uncovered a widespread malware campaign named Midnight Mimosa that is preinstalled in the firmware of low-cost Android smartphones. Because the malicious code is embedded at the system level before devices reach consumers, it is nearly impossible to remove through standard factory resets or application uninstallation.

The malware specifically targets budget devices utilizing MediaTek chipsets, including certain models from brands like Doogee and Cubot, as well as counterfeit devices impersonating premium flagship models. Once active, the malware operates with system-level privileges, allowing attackers to remotely install or delete applications, grant themselves permissions to SMS and accessibility services, and execute arbitrary code.

The primary objectives of the campaign appear to be financial. Attackers use the infected devices to generate revenue through ad and click fraud by using invisible overlays on legitimate apps. Additionally, the malware turns thousands of devices into residential-proxy relay nodes, effectively creating massive botnets that can be rented out for DDoS attacks. The campaign has been observed in over 150 countries, with significant concentrations in Mexico, France, Italy, the United States, Germany, Brazil, and Spain.

Entities

Android · Bitdefender · Cubot · Doogee · Google Play Store · MediaTek · Midnight Mimosa

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

Ciberseguridad en redes 5G y telecomunicaciones [www.tecnogus.com.co]
Low-cost Android phones are arriving with malware that owners can’t uninstall [cybernoz.com]
Alertă pentru românii cu telefoane Android ieftine! Mobilul poate fi infectat înainte să ajungă în mâinile tale [sibiu100.ro]
Některé levné mobily v sobě mají předinstalovaný nebezpečný malware. Nepomáhá ani jeho smazání - CHIP. cz [www.chip.cz]
Descubren malware preinstalado en teléfonos Android [cybersecuritynews.es]
Malware Found Preinstalled on Cheap, Counterfeit Android Phones [me.pcmag.com]
Experts warn of new Android phones sold with preinstalled cyber threats [www.stiripesurse.ro]
Experts warn cheap Android phones are being shipped with malware built in, so be on your guard [www.techradar.com]
Vorinstallierte Malware macht günstige Android-Smartphones zum Sicherheitsrisiko [www.it-daily.net]
Tysiące telefonów z ukrytym zagrożeniem. Zwykły reset nie wystarczy [www.dobreprogramy.pl]
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies [thehackernews.com]
Auch in Deutschland: Billig-Smartphones mit vorinstallierter Malware im Umlauf [www.focus.de]