Low-cost Android phones ship with 'Midnight Mimosa' residential proxy malware

Firmware-Embedded Malware Discovered

A malware campaign, dubbed 'Midnight Mimosa', has been identified on low-cost Android smartphones. This malicious software is embedded directly into the devices' firmware, granting it system-level privileges. The malware enables attackers to silently install applications, conduct ad fraud, and convert infected devices into residential proxies.

Supply Chain Infection

The malware is believed to have been introduced into the device supply chain, though the exact point of tampering and responsible party remain unknown. It primarily affects devices utilizing MediaTek chipsets. Bitdefender researchers reported that the campaign impacted thousands of devices across more than 150 countries over approximately two years, with significant concentrations in Mexico, France, Italy, the United States, Germany, Brazil, and Spain.

Affected Devices and User Reports

Preinstalled malware was found on devices with model names associated with legitimate manufacturers, including Doogee S200 X and Cubot KINGKONG X, as well as phones impersonating Samsung and Apple products. Users on XDA forums reported suspicious applications that reinstalled themselves after removal. One Doogee Fire 3 Max owner noted that an official firmware update introduced the malware, which reappeared after re-installing the update.

Malware Characteristics and Persistence

Unlike typical Android malware, 'Midnight Mimosa' is present in the device's system partition upon purchase. The malicious programs mimic legitimate Android system packages, using names such as com.android.system.lite, com.android.sys.prot, and com.android.sys.gmsprot. Due to being signed and running with elevated system privileges, these applications cannot be removed through standard Android methods.