Low-cost Android phones from several brands are leaving the factory with malware built into their firmware, according to research from Bitdefender reported by BleepingComputer Thursday. The malware, which Bitdefender calls Midnight Mimosa, can install apps silently, generate fraudulent ad views and turn handsets into residential proxies for other people's internet traffic.

What Happened

Bitdefender found the malware on devices built around MediaTek chipsets, including the Doogee S200 X, Doogee Fire 3 Max and Cubot KingKong X, as well as knockoff phones made to look like Samsung and Apple products. Thousands of devices in more than 150 countries have been infected over about two years. The largest numbers were in Mexico, France, Italy, the United States, Germany, Brazil and Spain.

The malicious code runs as system apps with names designed to look routine, such as com.android.system.lite and com.android.sys.prot. BleepingComputer reported that the malware is believed to have entered somewhere in the device supply chain, but it is unclear who modified the firmware or at what stage.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Some manufacturers have released firmware updates that address the infections, according to the report, without publicly explaining how the code got there.

How the Scheme Works

Because it runs with system privileges, Midnight Mimosa can install and remove apps without the owner's knowledge, change app permissions and run code sent from a remote server. Bitdefender said it disabled the Google Play Store during installations to avoid detection and altered installer records so the dropped apps appeared to have come from Google Play.

The system components do not commit the fraud themselves. Instead, they drop cover apps such as weather tools, file managers, note-takers, app lockers, OCR scanners and audio editors. Those apps load real advertisements through a legitimate ad software kit, but display them in hidden windows, so impressions are counted and paid for without anyone seeing the ads. Bitdefender also found 13 apps on the Google Play Store that contained the same ad-fraud code.

One of the dropped apps, disguised as an app locker, carries a TCP proxy component. It registers the phone with a command server, which can then tell the device to connect to chosen hosts and forward traffic through it. Bitdefender said the command infrastructure was still active and accepting new device registrations.

Why It Matters

Residential proxy networks are attractive to fraudsters and attackers because traffic routed through a home or mobile connection looks like an ordinary consumer rather than a data center. An infected phone owner may be unaware that their connection is being used, and could face slower service, higher data use or traffic that traces back to their address.

The case also shows the limits of app store screening. Malware installed in firmware never passes through Google Play review, and system-level placement means the standard Android uninstall option does not work. BleepingComputer said removal requires firmware-level cleanup or disabling the malicious component with Android Debug Bridge, a developer tool that many consumers have never used.

Preinstalled malware on inexpensive Android hardware is a recurring problem. Sellers of unbranded or lookalike phones often provide little information about who built the firmware or how it is updated.

What to Watch

BleepingComputer's report did not include responses from Doogee or Cubot. Owners of affected models should check for firmware updates from the manufacturer and look for unfamiliar system packages, including the names Bitdefender published.

With the command servers still running, the size of the proxy network could keep growing as more infected phones are sold and switched on, unless the infrastructure is taken down or more vendors ship clean firmware.