Bitdefender finds preinstalled Android malware you can’t uninstall, seen in 150 countries

A campaign named Midnight Mimosa involves preinstalled Android malware on low-cost phones utilizing MediaTek platforms. This malware is embedded in the device firmware and persists even before the user activates the device. The malware possesses system-level privileges, enabling unauthorized actions like installing and removing applications, granting permissions, and downloading code remotely without user knowledge. This capability allows operators to control infected devices and deploy them into botnets, primarily for financial gain through ad and click fraud, data collection, and creating residential-proxy relay nodes for DDoS attacks.
The malware operates by tricking the system; it disguises fraudulent activities using cover applications that load legitimate ads while an invisible layer registers impressions. A core component, identified as com.android.system.lite, exhibited anomalous behavior by repeatedly enabling sensitive access permissions like Accessibility and Notification Access. The malicious code is distributed across multiple package names with different signing certificates, indicating a complex distribution strategy where the shared malicious code is the primary threat.
The operation leverages Google Play for distribution, using thirteen apps to connect to shared servers under various developer accounts. The malware uses a native library to fetch remote configurations and loads plugins that execute ad fraud and silent installs, resulting in applications disguised as utility tools taking control of the device environment. The infrastructure connects to a control host over raw TCP on port 6000, utilizing domain rotation across four domains for command and traffic routing.

* Midnight Mimosa is a malware campaign targeting Android devices running MediaTek platforms.
* Malware is built into the device firmware and is present before the owner turns on the phone.
* The malware has system-level privileges, allowing installation/removal of apps, permission grants, and remote code downloads.
* Operators use infected devices for ad/click fraud, data collection, and acting as residential-proxy relay nodes in botnets.
* Revenue generation occurs through ad fraud, data collection, and proxy node operation for DDoS attacks.
* Fraud is generated by cover apps loading ads via legitimate SDKs while an invisible layer registers them.
* A component named com.android.system.lite exhibited malicious behavior by enabling Accessibility and Notification Access repeatedly.
* The malware uses a native library (libeasy.so) to fetch configuration from a command server disguised as a weather API.
* Payload applications are disguised as tools like app lockers, weather apps, file managers, etc., installing at least 32 different apps.
* Installation circumvents Play Protect by temporarily disabling the Google Play Store and recording it as an installation source.
* The operation utilizes firmware signed with certificates linked to Shenzhen Zediel on many affected devices.
* Malware infrastructure connects to a control host over raw TCP port 6000 across four domains.

The narrative pivots on the failure of traditional security models, specifically the assumption that static scanning is sufficient for mobile device security. The threat exists because the malware resides in system partitions, bypassing standard post-installation checks like Play Protect or simple application removal. This forces a re-evaluation of defense strategies, shifting focus from application-level vetting to deep system integrity and behavior monitoring, as demonstrated by App Anomaly Detection.
The pattern observed is a sophisticated supply chain exploit combined with persistence techniques aimed at undermining user-facing security tools. Attackers effectively camouflage malicious activity within legitimate system calls and services, using the perceived legitimacy of official application stores for distribution, which creates a necessary blind spot for defenses relying on standard app review processes. The use of fake device identities and firmware signing certificates points toward an exploitation of hardware counterfeiting in the global supply chain as a delivery mechanism.
The implication for human agency centers on the difficulty users face in exercising control over devices they own, especially when the malicious code is deeply entrenched at the firmware level. Since standard defenses fail to address preinstalled malware's location and persistence, true sovereignty requires mechanisms operating at the hardware or firmware layer, rather than relying solely on endpoint software controls. The costs are borne by the user who cannot easily clear the infection, and the benefit accrues entirely to operators leveraging these compromised nodes for illicit activities like DDoS infrastructure.
Bridge Questions: What regulatory frameworks must evolve to address malware embedded in preinstalled firmware across diverse hardware platforms? How can security tooling be designed to effectively monitor dynamic, context-aware system behavior rather than relying on static signatures when dealing with deeply integrated threats? What responsibility do hardware manufacturers and supply chain partners hold for securing the integrity of firmware delivered to end-users?