Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies.

The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa.

The preinstalled malware ("com.android.system.lite") runs with system-level privileges, which make it possible to install or uninstall a rotating set of at least 32 disguised apps, grant itself additional permissions to accessibility services, notifications, and SMS, and load arbitrary code supplied remotely by the operators.

Specifically, it fetches a remote configuration from an external server and then downloads and executes additional payloads designed to conduct ad fraud and silent installation or removal of partner apps. These apps incorporate proxyware, ad fraud, and code execution features. It can also grant permission to any Android app package.

"This essentially means its operators could install and delete apps at will, tuning each device to their needs, including making them part of large botnets," the Romanian cybersecurity company said.

"This scheme is likely designed mainly to generate revenue. The operators carry out ad and click fraud, collect device and installed-app information, and turn infected devices into residential-proxy relay nodes, making them zombies in botnets."

It's worth emphasizing that the malware itself doesn't engage in fraudulent clicks. Instead, the monetization effort is driven by dropper apps that masquerade as seemingly harmless utility apps, which are responsible for loading genuine ads through a legitimate advertising software development kit (SDK). The end goal is to load an invisible window on top of apps that registers the ads being shown.

In all, Bitdefender said it discovered 13 apps on Google Play that communicate with the same servers that control the malware, indicating the campaign is not limited to preinstalled firmware. Unlike the preinstalled malware, the Play Store apps provide genuine functionality, such as weather information or QR-code scanning. But they also load and display ads outside the apps, including when a user is not actively using the phone.

The names of the apps are listed below. None of them are currently available for download from the Play Store -

• Wavrge (com.audify.editor.wavrge)
• App Icon DIY (appicon.diy.tools.prop)
• Audify (com.audify.editor.pro)
• QR Pocket (com.prorestore.qr)
• All Deleted Messages Recovery (com.message.recovery.prorestore)
• WeatherGo (com.go.weather.mot)
• CoolWeather (com.cool.weather.yl)
• Daily Weather (com.dmstudio.weather)
• Lock & Hide (com.dl.guard.lock)
• QuickText Extractor (picturetranslate.extractor.text.lite)
• NoteMaster (com.notemaster.record.mark)
• Tap to Translate (com.arabmusic.tap.aghani_tamerhosny)
• Tasky (org.life.goal.tools)

A notable aspect of the malware is that it disables the Google Play Store app prior to installing a payload app, likely in an attempt to bypass Play Protect safeguards, and then re-enable the app after the payload is run.

What's more, the malware has been detected on devices with firmware signed using certificates attributed to Shenzhen Zediel Co., Ltd, a Chinese Android device manufacturer. However, it's unclear at this stage if the certificate owner was involved in or aware of the malware deployment. However, Bitdefender noted that it also detected other company names over the course of its investigation.

The preinstalled nature of the malware suggests a compromise of the device supply chain, with Bitdefender highlighting some level of infrastructure overlaps with Android.Phantom, which was documented by Doctor Web in January 2026 as bundled within modded games and popular apps to conduct click fraud.

The vast majority of the infected devices are located in Mexico, followed by France, Italy, the U.S., Germany, Brazil, Spain, the U.K., Canada, Romania, Poland, and Thailand. Collectively, the campaign has been observed on thousands of unique devices across more than 150 countries over roughly two years. Many of the impacted phones appear to be low-cost, white-label or counterfeit devices, including models that borrow the names of better-known Samsung Galaxy phones and even Apple iPhones.

This is not the first time a firmware-level backdoor has been observed targeting Android devices. Late last year, Kaspersky disclosed details of another malware codenamed Keenadu that was discovered preinstalled on certain models of tablets running Android to primarily enable ad fraud.

"Preinstalled malware is a different threat class," Bitdefender said. "Every user-facing defense assumes the owner is in the loop at installation: the install prompt, the store review, Play Protect, and the ability to uninstall afterwards."

"Remediation cannot rely on uninstall. Because the root component ships in the system partition, an affected owner cannot remove it by the normal route. Clearing the device requires firmware-level cleanup or disabling the component over ADB, and neither is realistic for most people who own these phones. The durable fix sits with the vendors and the marketplaces that ship and sell the affected firmware."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.