Midnight Mimosa: Preinstalled Android Firmware Malware Turns Low-Cost Phones into Ad-Fraud Bots and Potential Proxy Nodes

Linha do tempo

1. gbhackers.com ↗ · pub. 20/10/2026 04:41 · coletado 20/10 05:00 primeiro registro

   Midnight Mimosa: Preinstalled Android Firmware Malware Turns Low-Cost Phones into Ad-Fraud Bots and Potential Proxy Nodes

   ler a análise desta fonte ocultar

   Bitdefender documented Midnight Mimosa, an Android malware campaign that embeds a platform-signed malicious system app in the firmware of low-cost, MediaTek-based handsets and counterfeit flagship models before they reach buyers. Thousands of infected devices were observed in more than 150 countries over roughly two years. The implant drives advertising fraud and carries proxyware capability that could turn devices into residential proxy nodes. Removing visible apps does not fix the infection because the firmware-level enabler persists.

   Technical Details

   • The initial enabler, com.android.system.lite, impersonates an OS component and holds INSTALL_PACKAGES, DELETE_PACKAGES, GRANT_RUNTIME_PERMISSIONS and WRITE_SECURE_SETTINGS.
   • The native library libeasy.so uses RC4 to decrypt an embedded Java framework. The framework fetches remote configuration and downloads DEX/JAR plugins, so operators can change behavior without replacing the firmware implant.
   • C2 and module infrastructure includes api.weatherlive.world and oss.showtimetool.com. The weather-themed naming helps blend in with routine traffic.
   • Before deploying payloads, the enabler temporarily disables the Google Play Store package and then restores it. Bitdefender assesses this as an attempt to evade Play Protect.
   • The plugin com.wz.sdk.DxFactory drives ad fraud using hidden windows and automated interactions that fabricate impressions, clicks and conversions. com.earnsdk.lib.DxFactory and com.gogo.third.lib.DxFactory handle silent app installs and removals.
   • At least 32 disguised payload apps were identified (weather tools, app lockers, OCR utilities, file managers). Some claim Google Play provenance without a valid Play signature block.
   • 13 related apps on Google Play shared the ad-fraud markers and infrastructure but lacked the system-level privileges.
   • com.mobile.applock.en contains EnLoaderLib proxyware that can register devices and open bidirectional TCP tunnels. Bitdefender's dynamic test did not capture actual traffic relaying, and one control endpoint turned out to be a sinkhole.
   • Telemetry concentrations are highest in Mexico, France and Italy, followed by the US, Germany, Brazil and Spain. This reflects telemetry distribution, not confirmed targeting.
   • Some firmware certificates referenced Shenzhen Zediel Co., Ltd., but the point of supply-chain compromise and the certificate owner's involvement could not be established. Overlaps with Android.Joker, Android.Phantom and Android.Click do not prove common ownership, and no direct link to FBI-warned BADBOX 2.0 was established.

   Remediation

   • Uninstalling visible payload apps is insufficient, since the privileged enabler can reinstall replacements and pull new code.
   • Assess trusted firmware reflashing or hardware replacement for affected devices.
   • Enterprises should limit procurement of inexpensive unvetted handsets and restrict unmanaged BYOD devices from sensitive network access.