Cheap Android Phones Ship With Hidden Malware That Quietly Turns Them Into Proxy Nodes

Researchers at Bitdefender have uncovered a campaign, tracked as Midnight Mimosa, in which low-cost Android smartphones built on MediaTek platforms are sold with malicious software already in the firmware. The malware (named com.android.system.lite) runs with system-level privileges. This lets it install or remove a rotating set of at least 32 disguised apps, give itself extra permissions for accessibility services, notifications and SMS, and run code supplied remotely by its operators.

The malware fetches a configuration from an external server, then downloads further components for ad fraud and for silently adding or removing partner apps. These apps include proxyware, which can turn a phone into a residential proxy relay node, as well as ad fraud and code execution features. Bitdefender says the scheme is likely designed mainly to generate revenue, and that operators could tune each device to their needs, including making it part of a large botnet.

The malware does not click on ads itself. Dropper apps posing as harmless utilities load genuine ads through a legitimate advertising SDK, then place an invisible window over other apps to register the ads shown. Bitdefender also found 13 apps on Google Play talking to the same control servers, so the campaign is not limited to preinstalled firmware. These apps offered real features such as weather information or QR-code scanning, but displayed ads outside the apps, even when the phone was not in use. None are currently available on the Play Store.