Dev
Hidden program in cheap Android phones turns them into advertising tools from the factory
Dev.toUnited States · NORTH AMERICA
Bitdefender details Midnight Mimosa, a preinstalled firmware malware found on low-cost MediaTek-based Android devices across 150+ countries. The analysis covers its system-level privileges, platform-s...
Bitdefender details Midnight Mimosa, a preinstalled firmware malware found on low-cost MediaTek-based Android devices across 150+ countries.
The analysis covers its system-level privileges, platform-signed packages, native RC4 payload decryption, and dynamic module loading used for ad fraud and proxy operations.
According to researchers at security firm Bitdefender, the problem is hidden within the manufacturer's core software and not in an app downloaded later by the user. This means that the phone comes with the problem from the factory, which makes it impossible to remove it using standard methods.
How does stealth mode work?
The hidden program is designed to run in the background without being noticed. When the device starts, the system decrypts hidden pieces of code and downloads additional files from the Internet.
The perpetrators use this mechanism primarily to generate fake advertising traffic, earning money from automatically clicked ads. At the same time, the program can turn the device into a network hub, allowing third parties to route their traffic through the unsuspecting owner's internet connection.
Who is affected?
The research showed that thousands of devices in more than 150 countries have been affected. Mexico, France and Italy are at the top of the list, followed by the United States, Germany, Brazil and Spain.
The affected phones are mostly budget devices from various brands that have specific processors, while some of them even bore fake labels of well-known and expensive models. Researchers also found that the program temporarily disables the phone's official app store to avoid detection, before re-enabling it.
Why is removal difficult?
Because the problem is deeply rooted in the device's core software, ordinary users cannot delete it using traditional app uninstallation methods. The definitive solution requires intervention in the manufacturer's software.