Cheap Android phones sold with malware pre-installed – "Midnight Mimosa" campaign

Some budget-priced Android phones reach consumers with dangerous programmes already integrated into the system, allowing advertising fraud and remote control.

Cheap Android phones sold with malware pre-installed – "Midnight Mimosa" campaign

Malware pre-installed on cheap Android phones, discovered by Bitdefender

Cybersecurity researchers at Bitdefender have identified a cyber threat campaign called Midnight Mimosa, which targets budget-priced Android phones marketed under various brands, ProTV News reports. Dangerous programmes are integrated directly into the device software before they reach consumers, meaning the phone can be compromised from the first power-on.

The investigation, released on Monday and cited by Agerpres, identified the threat on devices equipped with MediaTek processors, including models marketed under names that mimic premium products from well-known manufacturers.

What attackers can do

According to cybersecurity experts, attackers gain extended control over infected devices. "Attackers can install and remove applications without the owner's consent, can generate revenue through fraudulent ads and clicks on advertisements and can use the phone's internet connection to direct traffic from other persons," the specialists cited in the research specify.

The dangerous programme is disguised as a legitimate Android system component and benefits from extended access rights, communicating with servers controlled by attackers without notifying the user. Unlike usual attacks, the user does not need to download any suspicious application or access unsafe websites for the device to be compromised.

Invisible ads and botnet networks

Applications later installed by attackers can mimic common programmes — weather forecasts, file management, notes or image processing. "In reality, some of them are used to load advertisements without the user's knowledge and to generate fake displays or clicks, from which attackers obtain revenue," the cited source shows.

Researchers also identified components that transform compromised devices into intermediate proxy servers. Through these, unauthorised persons can direct internet traffic through the affected phone's connection, without the owner's knowledge. "Phones can thus become part of networks of compromised devices, known as a botnet, which can be used for various abusive computing activities, including supporting distributed denial-of-service attacks on online services," the research conclusions note.

Supply chain, difficult to audit

A central aspect of the investigation concerns the compromise of the supply chain. When a device's software is developed, modified or distributed by multiple companies, identifying the stage at which malicious code was introduced becomes difficult. In the Midnight Mimosa case, researchers confirmed the presence of the threat in the software of affected devices, without establishing with certainty at what stage of the production or distribution process it was introduced.

Furthermore, even factory reset does not guarantee the elimination of the threat, as it is integrated into operating system components. "Complete remediation may require replacement of system software with a secure version provided by the manufacturer," the report conclusions state.

Signs that warrant checking the device

According to Bitdefender's analysis, among the indicators that should prompt a phone check are:

"These indicators do not automatically confirm the presence of Midnight Mimosa and may have other causes. However, they warrant checking the device with a reliable cybersecurity solution and, if necessary, contacting the seller or the manufacturer," the specialists specify.

Expert recommendations

Cybersecurity experts recommend several preventive measures: purchasing phones from trustworthy sources and verifying device authenticity at purchase; regularly updating the operating system and installed applications; checking Google Play Protect certification; using a reliable cybersecurity solution; avoiding use of suspicious devices for sensitive activities, such as banking operations or accessing personal accounts.

How the campaign was discovered

The Midnight Mimosa investigation was initiated after Bitdefender's suspicious behaviour detection technologies, integrated directly on the device, identified a component that presented itself as part of the Android system but carried out activities incompatible with legitimate operation. The company validates 50 billion threat queries daily and discovers hundreds of new cyber threats every minute, and its technologies are licensed to over 200 security brands worldwide.

Source: Știrile ProTV

Read this article in the original language