Android.Phantom (Malware): news timeline & CVEs

Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Preinstalled Midnight Mimosa malware on cheap Android phones enables ad fraud and residential proxies.

Bitdefender reports that low-cost Android phones built on MediaTek platforms shipped with preinstalled malware it calls Midnight Mimosa. The system component com.android.system.lite fetches remote configuration, installs or removes at least 32 apps, and supports ad fraud and residential-proxy use. Thirteen related Google Play apps have been removed. Infections were seen on thousands of devices across more than 150 countries over roughly two years, mostly in Mexico, with firmware certificates linked to Shenzhen Zediel.

The Hacker NewsOct 13, 06:00 UTC · 3d agoMalware in the wild 5 sources2· 1 read

Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue

Midnight Mimosa, preinstalled Android firmware malware, monetizes thousands of phones in 150 countries through ad fraud and proxies.

Bitdefender disclosed Midnight Mimosa on October 8, Android malware embedded in firmware that monetizes phones through ad fraud and residential proxies. The operation hit thousands of inexpensive MediaTek-based devices in more than 150 countries over about two years, led by Mexico, France, and Italy. A privileged component pulls configuration from weather-themed infrastructure, silently installs at least 32 ad-fraud apps, and can disable the Play Store package. Payload com.mobile.applock.en relays traffic on port 6000; researchers did not confirm a DDoS campaign or a named actor.

GBHackersupdated Oct 13, 06:00 UTC · 3d agofirst Oct 12, 08:53 UTC · 4d agoMalware in the wild 5 sources2

Android.Phantom

Timeline2 articles

Appears with

Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue