Bitdefender discovered a malware pre-installed in the firmware of cheap Android smartphones, active for about two years and named Midnight Mimosa. The code is already on board when the phone comes out of the box, before the first power on. The researchers counted on it thousands of unique devices in more than 150 countrieswith Mexico, France and Italy at the top of the list of the most affected, followed by the United States, Germany, Brazil and Spain.
Midnight Mimosa you don’t need to convince anyone to install it. Travel signed with the device platform key and turn with system privileges: installs and removes applications, grants sensitive permissions, runs modules downloaded from command servers without the user touching the screen. The common thread of the infected devices is the MediaTek platform.
In the list of models real trade names appear such as Doogee S200X And Cubot KINGKONGalong with clones that pass themselves off as other people’s top of the range (builds sold as S25 Ultra, S24 Ultra and S26 Ultra). The compromised images fall into European regional variations: J10_EEA, A9_EEA, T13_EEA and Q6_EEA.
The offending packages mimic system components with credible names: com.android.system.litecom.android.sys.prot, com.android.sys.gmsprot, and com.android.sys.bcprot. It was the first one, reported by the App Anomaly Detection technology while it silently installed and uninstalled other applications, that attracted the attention of analysts.
Phantom advertising and telephones used as a bridge
The profit comes from advertising. The system app acts as the director and leaves the dirty work to around thirty decoy applications (weather, app lock, file managers, notes, OCR, audio editor) that load real banners via a legitimate advertising SDK, then show them in invisible windows overlaid on other screens. Fake clicks adjust remotely with parameters like silentPercent and daily caps, while conversions are reported later 60 seconds.
To go under the radar, the malware temporarily deactivates com.android.vending just before a silent installation, neutralizing Play Protect, and re-enables it immediately afterwards. In some variants it also spoofs the installer field, so hostile apps appear to be downloaded from the Play Store.
There is also the proxy function. The application com.mobile.applock.en integrates a TCP component (EnLoaderLib 1.0.6) which registers the phone as a node in a network residential proxiesready to route other people’s traffic behind the victim’s home connection. The control infrastructure accepted new registrations, but in the tests no targets arrived to forward.
Source: BleepingComputer
The same advertising code ended up on 13 applications distributed on Google Playsigned with 13 different certificates and attributable to at least two developer accounts (fivedev and CPS Developer). Without system privileges they cannot install anything secretly, but they still show ads outside their interface, even when the phone is unused.
It is not yet clear how the code found its way into the official images. On the XDA forum, several Cubot and Doogee owners described applications that returned after each removal, and a Doogee Fire 3 Max user said he was infected via an official update, with the problem disappearing when returning to a previous build and reappearing when reinstalling the new one. Some manufacturers have released corrective firmware without adding a word about the source of the problem.
For those who are already affected, the only way out is a firmware-level cleanup or disabling the component via ADB: technically feasible, practically out of reach for almost everyone.
