Cheap Android Phones Come Preloaded with Malware

Low-cost Android devices built on MediaTek platforms have been found to ship with preinstalled malware named Midnight Mimosa. This malware operates with system-level privileges, allowing it to install or uninstall apps, grant additional permissions, and execute arbitrary code remotely. It fetches configurations from external servers to conduct ad fraud, install partner apps, and turn devices into residential proxies for botnets. Bitdefender identified 13 apps on Google Play that communicate with the same servers controlling the malware, indicating the campaign extends beyond preinstalled firmware. The malware disables the Google Play Store to bypass Play Protect safeguards before re-enabling it. Infected devices are primarily located in Mexico, France, Italy, the U.S., and other countries. The preinstalled nature of the malware suggests a supply chain compromise, with infrastructure overlaps noted with Android.Phantom.