From Newsgroup: comp.os.linux.advocacy

On 10/8/26 5:47 PM, CrudeSausage wrote:

<https://shorturl.at/j0vFy>

Low-cost Android phones ship with residential proxy malware
By Lawrence Abrams
October 8, 2026 03:20 PM 1
Android Malware

A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-
cost Android smartphones that ship with malicious software embedded in
their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies.

The malware is believed to have been introduced somewhere in the device supply chain, but it remains unclear who is responsible for modifying
the firmware or at what stage the tampering occurred.

The malware is embedded directly into the firmware of low-cost Android devices using MediaTek chipsets, giving it system-level privileges that allow it to install and remove applications, grant sensitive
permissions, and execute remotely downloaded code without user interaction.

According to Bitdefender researchers, the campaign affected thousands of devices across more than 150 countries over approximately two years,
with the highest number of victims in Mexico, France, Italy, United
States, Germany, Brazil, and Spain.

The researchers found preinstalled malware on devices with model names associated with legitimate manufacturers, including the Doogee S200 X
and Cubot KINGKONG X, as well as phones impersonating Samsung and Apple products.

In an XDA forums post, owners of Cubot and Doogee smartphones reported finding suspicious applications that repeatedly reinstalled themselves
after removal.

One Doogee Fire 3 Max owner also reported that an official firmware
update infected the device with the malware, which disappeared after restoring an older firmware version but returned when the update was installed again.

Some users said the manufacturers released firmware updates that
resolved the infections. However, the manufacturers have not publicly explained how the malicious software was introduced into the affected firmware.

Bitdefender also mentioned the XDA forum post in its report and said one
of the malware packages reported by forum users, com.android.non.szcz,
is part of the same malware family.

Pre-installed Android malware
Unlike typical Android malware that requires users to install a
malicious application, Midnight Mimosa is already installed in the
device's system partition when customers receive their phones.

The malicious programs impersonate legitimate Android system packages,
using names such as com.android.system.lite, com.android.sys.prot, and com.android.sys.gmsprot.

Because these applications are signed and run with elevated system privileges, they cannot be removed through Android's normal application uninstall process.

Bitdefender discovered the campaign after its App Anomaly Detection technology flagged a suspicious system application named com.android.system.lite that was silently installing and removing other applications.

Further investigation determined that the application was part of a
larger malware framework that downloads additional modules from command- and-control (C2) servers to perform different malicious activities.

The researchers identified approximately 32 applications distributed
through the framework, including apps disguised as weather utilities,
file managers, app lockers, OCR tools, and audio editors.

"The system app itself doesn’t register the fraudulent impressions and clicks," explains Bitdefender.

"The revenue engine is driven by the dropped cover apps, including real- looking weather, app-lock, note, and OCR apps, which load genuine ads through a legitimate ad SDK. The goal is simple: to load an invisible
window on top of apps that registers ads being shown."

These applications are used to generate fraudulent advertising
impressions and clicks, with some displaying advertisements in hidden windows or automatically interacting with ads without the device owner's involvement.

The malware also employs techniques designed to evade Android's security protections.

Before silently installing malicious applications, it temporarily
disables the Google Play Store app, com.android.vending, which
Bitdefender says is intended to prevent Google Play Protect from
detecting the installation.

After the installation completes, the malware re-enables the Play Store
to avoid raising suspicion.

Some malware variants also manipulate Android's recorded installer information to make malicious applications appear to have been installed through Google Play, even though they were deployed directly by the
malware.

The malware also includes features that turn infected Android phones
into residential proxies that can relay network traffic.

Bitdefender identified a malicious application disguised as an app
locker, com.mobile.applock.en, which contains a TCP proxy component that registers infected devices with a remote command server.

Once registered, the malware can be sent instructions to connect to specified hosts and forward traffic through the infected device.

This could allow attackers to route malicious traffic through the
internet connections of phone owners, concealing the true origin of
attacks or allowing access to devices reachable from the infected device.

Bitdefender confirmed that the proxy command-and-control infrastructure
was operational and accepting device registrations.

However, during their tests, the researchers said their newly registered device did not receive any relay targets, so they could not confirm
whether the attacker's were actively forwarding traffic.
The researchers also discovered 13 Android applications distributed
through the Google Play Store that contained the same advertising fraud
code and communicated with known Midnight Mimosa infrastructure.

Unlike the preinstalled system components, these applications do not
have elevated privileges needed to silently install other software.

However, they can still display advertisements outside their user
interface, including when users are not using the phone.

The applications were distributed using 13 different signing
certificates and at least two developer accounts, identified as fivedev
and CPS Developer.

The researchers also found firmware signed using certificates associated with Chinese device manufacturer Shenzhen Zediel, but said it is unclear whether the company was involved in the malware's campaign.

For affected consumers, removing the malware is difficult because the malware is installed as a high-privileged system application.

Bitdefender says removing the infection requires firmware-level cleanup
or disabling the malicious component using Android Debug Bridge (ADB),
which can be complicated for many users.

Far from the first time
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: comp.os.linux.advocacy

Tom Elam wrote:

Bitdefender says removing the infection requires firmware-level cleanup
or disabling the malicious component using Android Debug Bridge (ADB),
which can be complicated for many users.

Far from the first time

Why is it the Apple Usenet poster always has to compare their $1000 iPhone
to a $39.99 no-name Android, in order to find something (anything!) better?
--- Synchronet 3.22a-Linux NewsLink 1.2