Thousands of Android Phones Ship with Pre-Installed Malware

Key Takeaways

• Thousands of Android smartphones have been found with pre-installed firmware malware dubbed “Midnight Mimosa.”
• This malware grants attackers system-level access without user interaction, affecting devices in over 150 countries.
• The threat primarily targets low-cost Android phones, including MediaTek-based models and counterfeits of popular brands.
• Midnight Mimosa can secretly install/remove apps, execute arbitrary code, and generate fraudulent ad activity while temporarily disabling Google Play Protect.
• The persistent nature of firmware-embedded malware necessitates specialized cleanup beyond simple app removal.

Thousands of Android Phones Ship With Hidden Malware

A widespread malicious campaign, identified as “Midnight Mimosa,” has infected thousands of Android devices across more than 150 nations. The malware is embedded directly into the firmware of these phones before they even reach consumers, providing attackers with deep system-level control. This alarming discovery means users are compromised from the moment of purchase, bypassing traditional attack vectors like malicious app downloads or phishing links. The campaign predominantly targets lower-cost Android handsets.

The core functionality of the Midnight Mimosa malware includes the clandestine installation and uninstallation of applications, the execution of arbitrary code, and the generation of fraudulent advertising traffic. A critical evasion tactic employed by the malware involves temporarily disabling the Google Play Store package before deploying additional payloads, then reactivating it. This maneuver is believed to be a sophisticated attempt to circumvent detection by Google Play Protect, rather than a permanent disabling of the security feature.

The firmware-level access of this malware was highlighted in an October 19 research report by Researchers from PolySwarm noted. Their findings build upon an extensive investigation by Bitdefender, which documented thousands of infected devices over approximately two years. The highest concentrations of observed infections were in Mexico, France, and Italy, followed by the United States, Germany, Brazil, and Spain. These figures reflect observed infection counts, not necessarily targeted geographical distribution.

How the Malware Operates

The initial infection vector is a malicious system application, validated by an Android platform certificate. This privileged signing grants the malware extensive capabilities, including the authority to manage application packages, revoke permissions, and modify protected system settings. This contrasts sharply with typical Android malware, emphasizing that merely scrutinizing downloaded applications is insufficient when the threat is inherent to the device’s foundational software.

The malicious component cleverly conceals its primary operations within a native library. Upon execution, this library utilizes RC4 encryption to decrypt and deploy a hidden Java framework. This framework then establishes communication with command-and-control (C2) servers to retrieve configuration settings and download additional code modules (DEX or JAR plugins). These plugins enable the attackers to dynamically alter the malware’s behavior without needing to replace the initial, firmware-embedded system application.

Various plugins serve distinct malicious purposes, such as ad fraud and silent application installation. Some modules are designed to simulate fake ad impressions, clicks, and conversion events through hidden browser windows and automated interactions. This fraudulent activity is often disguised as originating from legitimate utility applications like weather apps, app lockers, text scanners, or file managers. Bitdefender’s analysis identified at least 32 such disguised applications within the broader payload network.

How the Malware Evades Checks

The temporary deactivation of the Play Store creates a critical window for the malware to install additional software while attempting to bypass Google’s security checks. Furthermore, some malicious applications falsely report Google Play as their installer, despite lacking the legitimate signature block applied through Play Store distribution. This discrepancy allows forensic investigators to differentiate between a claimed installation source and the actual method of app deployment.

This detailed understanding complements earlier research into Midnight Mimosa’s firmware persistence, which noted the malware’s ability to maintain its presence even as its visible payloads evolve. Researchers also discovered 13 related ad-fraud applications distributed via Google Play. While these shared infrastructure and certain malware characteristics, they lacked the deep, privileged access afforded to the firmware-embedded component.

The primary enabler component of Midnight Mimosa also contains functionalities related to Accessibility, Notification Access, and SMS permissions, including mechanisms to automatically grant these sensitive access rights. While researchers did not observe these permissions being actively exploited for data theft during their analysis, the malware’s capacity to download new code means its potential future capabilities extend beyond the currently identified advertising modules.

Another identified payload includes proxy software, which can register a compromised device and establish two-way TCP tunnels. This functionality could potentially allow external traffic to be routed through an infected phone’s internet connection. While the underlying capability was confirmed, researchers did not observe active traffic relaying during their documented tests. An initial C2 endpoint was later identified as a sinkhole, indicating defensive measures or changes in attacker infrastructure.

This proxy capability echoes concerns seen with malicious residential proxy networks, where compromised consumer devices are leveraged to provide network access for other parties. Although there is no established link between these operations and Midnight Mimosa, the presence of such proxy functionality could expose residential or corporate networks to unauthorized traffic originating from compromised devices.

The affected devices span a range of products, including budget-friendly MediaTek-based phones, counterfeit versions of high-end models, and devices reporting identifiers linked to brands like Doogee and Cubot. Some firmware certificates associated with the malware carried identifiers connected to Shenzhen Zediel. However, researchers were unable to definitively determine the exact point of compromise within the supply chain or establish whether the certificate owner was knowingly involved. Similarly, observed connections to other malware families such as Joker, Phantom, and Click do not conclusively prove a shared operator. Effective remediation requires addressing the underlying firmware compromise, as merely removing visible malicious applications may leave the core enabler intact and capable of reinstalling new payloads. Google emphasizes that its app safety checks continuously scan devices, but this incident underscores the critical need for vigilance over trusted system components.

Indicators of compromise (IoCs):-

The following 40 sample SHA-256 hashes are provided. The original report does not link specific hashes to particular packages.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Be Wary of Low-Cost Devices: Exercise extreme caution when purchasing inexpensive or lesser-known brand Android phones, especially those from unofficial channels, as these are frequently targeted by firmware-level malware.
• Verify Device Authenticity: If possible, purchase devices from reputable vendors and authorized distributors to minimize the risk of receiving a compromised device.
• Monitor Network Activity: Implement network monitoring tools to detect unusual outbound connections or excessive data usage from mobile devices, which could indicate proxy activity or C2 communication.
• Consider Custom ROMs (Advanced Users): For technically proficient users, flashing a clean, verified custom ROM (e.g., LineageOS) onto a device, if supported, can replace the compromised firmware. However, this carries risks and may void warranties.
• Factory Reset Limitations: Understand that a factory reset will likely NOT remove firmware-level malware. The malicious component is deeply embedded and will persist across resets.
• Report Suspicious Devices: If you suspect your device is infected, consider reporting it to security researchers or your device manufacturer.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.