New research by Bitdefender shows that some new, low-cost Android phones are being sold with preinstalled cyber threats, allowing attackers to carry out advertising fraud and remotely control the devices.
According to research released on Monday, the cyber threat campaign, dubbed Midnight Mimosa, affects certain low-cost Android phones sold under various brands.
The malicious software is embedded in the devices' software before they reach consumers, meaning the phones can be compromised from the very first time they are switched on, without users having to install applications or visit unsafe websites.
The investigation identified the threat on devices using MediaTek processors, including some phones marketed under names that imitate premium models from well-known manufacturers.
"Attackers can install and remove applications without the owner's consent, generate revenue through fraudulent ad impressions and clicks, and use the phone's internet connection to route other people's traffic. Unlike common attacks on mobile devices, in which users are tricked into downloading a malicious application, Midnight Mimosa exploits compromised software installed on the phone before it is sold. Under these circumstances, simply avoiding applications from unknown sources is no longer enough to prevent infection. The malicious program is disguised as a legitimate component of the Android system and has extensive access privileges. This allows it to communicate with servers controlled by attackers, receive instructions, and install or remove other applications without notifying the user," cybersecurity experts said.
They also warn that applications installed later may imitate ordinary tools, such as weather forecasts, file managers, note-taking apps, access-blocking tools, and image and text processing applications. "In reality, some of these are used to load advertisements without the user's knowledge and generate fake impressions or clicks, from which attackers earn revenue," the cited source said.
Researchers also identified components that can turn compromised devices into proxy servers, allowing unauthorised individuals to route internet traffic through the affected phone's connection without the owner's knowledge.
"As a result, the phones can become part of networks of compromised devices known as botnets, which can be used for various forms of malicious cyber activity, including supporting distributed denial-of-service (DDoS) attacks against online services. (...) An important aspect of the investigation is the compromise of the supply chain. When a device's software is developed, modified or distributed by several companies, it can be difficult to identify the stage at which malicious software was introduced. In the case of Midnight Mimosa, researchers confirmed the presence of the threat in the software of the affected devices, but could not establish with certainty at which stage of the manufacturing or distribution process it was introduced. Furthermore, because the threat is embedded in operating system components, removing suspicious applications or restoring factory settings does not guarantee its removal. Full remediation may require replacing the system software with a secure version supplied by the manufacturer," the research findings note.
According to the analysis, warning signs that should prompt users to check their devices include the appearance of unknown applications, unusual advertising displays, excessive battery or mobile data consumption, frequent overheating and unexplained changes in the phone's behaviour. Differences between the model name shown in the system settings and the information provided at the time of purchase may also be cause for suspicion.
"These signs do not automatically confirm the presence of Midnight Mimosa and may have other causes. Nevertheless, they warrant checking the device with a cybersecurity solution and, if necessary, contacting the seller or manufacturer," the experts said.
In this context, cybersecurity specialists recommend, among other measures, purchasing phones from trusted sources; verifying device authenticity; updating the operating system and applications; checking installed applications and Google Play Protect certification; using a trusted cybersecurity solution; avoiding the use of suspicious devices for sensitive activities; and contacting the seller or manufacturer if a compromise is confirmed.
The Midnight Mimosa investigation began after Bitdefender's on-device suspicious-behaviour detection technologies identified a component that presented itself as part of the Android system but carried out activities inconsistent with its legitimate operation.
Bitdefender discovers hundreds of new cyber threats every minute and validates 50 billion threat queries daily. The company has consistently innovated in areas such as antimalware, the Internet of Things, behavioural analysis and artificial intelligence, and its technologies are licensed to more than 200 of the world's best-known security brands.
