Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies.

The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa.

The preinstalled malware ("com.android.system.lite") runs with system-level privileges, which make it possible to install or uninstall apps, grant itself additional permissions to accessibility services, notifications, and SMS, and load arbitrary code supplied remotely by the operators.

Specifically, it fetches a remote configuration from an external server and then downloads and executes additional payloads designed to conduct ad fraud and silent installation or removal of partner apps. These apps incorporate proxyware, ad fraud, and code execution features. It can also grant permission to any Android app package.

"This essentially means its operators could install and delete apps at will, tuning each device to their needs, including making them part of large botnets," the Romanian cybersecurity company said.

"This scheme is likely designed mainly to generate revenue. The operators carry out ad and click fraud, collect device and installed-app information, and turn infected devices into residential-proxy relay nodes, making them zombies in botnets."

It's worth emphasizing that the malware itself doesn't engage in fraudulent clicks. Instead, the monetization effort is driven by dropper apps that masquerade as seemingly harmless utility apps, which are responsible for loading genuine ads through a legitimate advertising software development kit (SDK). The end goal is to load an invisible window on top of apps that registers the ads being shown.

Source link