Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Preinstalled Midnight Mimosa malware on cheap Android phones enables ad fraud and residential proxies.
Bitdefender reports that low-cost Android phones built on MediaTek platforms shipped with preinstalled malware it calls Midnight Mimosa. The system component com.android.system.lite fetches remote configuration, installs or removes at least 32 apps, and supports ad fraud and residential-proxy use. Thirteen related Google Play apps have been removed. Infections were seen on thousands of devices across more than 150 countries over roughly two years, mostly in Mexico, with firmware certificates linked to Shenzhen Zediel.
76