Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue
Midnight Mimosa, preinstalled Android firmware malware, monetizes thousands of phones in 150 countries through ad fraud and proxies.
Bitdefender disclosed Midnight Mimosa on October 8, Android malware embedded in firmware that monetizes phones through ad fraud and residential proxies. The operation hit thousands of inexpensive MediaTek-based devices in more than 150 countries over about two years, led by Mexico, France, and Italy. A privileged component pulls configuration from weather-themed infrastructure, silently installs at least 32 ad-fraud apps, and can disable the Play Store package. Payload com.mobile.applock.en relays traffic on port 6000; researchers did not confirm a DDoS campaign or a named actor.
74