Shenzhen Zediel (Organization): news timeline & CVEs

Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Preinstalled Midnight Mimosa malware on cheap Android phones enables ad fraud and residential proxies.

Bitdefender reports that low-cost Android phones built on MediaTek platforms shipped with preinstalled malware it calls Midnight Mimosa. The system component com.android.system.lite fetches remote configuration, installs or removes at least 32 apps, and supports ad fraud and residential-proxy use. Thirteen related Google Play apps have been removed. Infections were seen on thousands of devices across more than 150 countries over roughly two years, mostly in Mexico, with firmware certificates linked to Shenzhen Zediel.

The Hacker NewsOct 13, 06:00 UTC · 3d agoMalware in the wild 5 sources2· 1 read

Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue

Midnight Mimosa, preinstalled Android firmware malware, monetizes thousands of phones in 150 countries through ad fraud and proxies.

Bitdefender disclosed Midnight Mimosa on October 8, Android malware embedded in firmware that monetizes phones through ad fraud and residential proxies. The operation hit thousands of inexpensive MediaTek-based devices in more than 150 countries over about two years, led by Mexico, France, and Italy. A privileged component pulls configuration from weather-themed infrastructure, silently installs at least 32 ad-fraud apps, and can disable the Play Store package. Payload com.mobile.applock.en relays traffic on port 6000; researchers did not confirm a DDoS campaign or a named actor.

GBHackersupdated Oct 13, 06:00 UTC · 3d agofirst Oct 12, 08:53 UTC · 4d agoMalware in the wild 5 sources2

Midnight Mimosa Infects Android Phones Before Users Even Turn Them On

Midnight Mimosa ships in low-cost Android firmware, silently running ad fraud and proxy modules before first boot.

Bitdefender reported Midnight Mimosa, Android malware preinstalled in firmware on low-cost MediaTek devices, affecting thousands of phones in more than 150 countries over about two years. A platform-signed system component decrypts an embedded APK with RC4, loads further DEX and JAR modules, and rotates at least 32 cover apps for fake ad clicks and possible residential-proxy enrollment. Mexico, France, and Italy led observed detections. Normal uninstall cannot remove the firmware component; researchers did not observe data theft or live proxy relay, and one suspected command server was a sinkhole.

Cyber Security Newsupdated Oct 13, 06:00 UTC · 3d agofirst Oct 12, 07:18 UTC · 4d agoMalware in the wild 5 sources7· 2 reads

Thousands of cheap Android phones shipped with ad-fraud malware

Bitdefender found ad-fraud malware preinstalled in the firmware of thousands of cheap MediaTek-based Android phones sold across more than 150 countries.

Bitdefender's campaign, dubbed Midnight Mimosa, involves ad-fraud malware preinstalled in the firmware of thousands of low-cost, often white-label or counterfeit MediaTek-based Android phones sold through mainstream online marketplaces. The system-level app cannot be uninstalled, silently installs or removes applications, grants permissions, and downloads additional code. It deploys at least 32 disguised utility apps that generate fraudulent ad impressions via invisible windows and automated clicks, and 13 related apps were found on Google Play. Detections span more than 150 countries over roughly two years, led by Mexico, France and Italy; attribution remains unknown, though some firmware was signed with Shenzhen Zediel certificates.

The RecordOct 8, 13:00 UTC · 8d agoMalware in the wild 2 sources3· 1 read

Shenzhen Zediel

Timeline4 articles

Appears with

Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue

Midnight Mimosa Infects Android Phones Before Users Even Turn Them On

Thousands of cheap Android phones shipped with ad-fraud malware