Thousands of cheap Android phones shipped with ad-fraud malware
Bitdefender found ad-fraud malware preinstalled in the firmware of thousands of cheap MediaTek-based Android phones sold across more than 150 countries.
Bitdefender's campaign, dubbed Midnight Mimosa, involves ad-fraud malware preinstalled in the firmware of thousands of low-cost, often white-label or counterfeit MediaTek-based Android phones sold through mainstream online marketplaces. The system-level app cannot be uninstalled, silently installs or removes applications, grants permissions, and downloads additional code. It deploys at least 32 disguised utility apps that generate fraudulent ad impressions via invisible windows and automated clicks, and 13 related apps were found on Google Play. Detections span more than 150 countries over roughly two years, led by Mexico, France and Italy; attribution remains unknown, though some firmware was signed with Shenzhen Zediel certificates.