Thousands of budget Android phone owners around the world have been hit with malware that was already on their devices before they ever switched them on.
The malware, dubbed Midnight Mimosa, is baked into the firmware of low-cost Android phones built on MediaTek chips, says cybersecurity firm Bitdefender.
The highest-volume models are the Doogee S200 X and the Cubot KINGKONG X, along with knockoff devices posing as Samsung and Apple phones.
Victims are spread across more than 150 countries, led by Mexico, France and Italy, then the US, Germany, Brazil and Spain.
Says Bitdefender,
“The malware ships preinstalled in the device firmware, and we found multiple system packages involved, depending on the device. It’s on the phone before the owner switches it on for the first time, and it can’t be uninstalled.”
Running with system-level privileges, the malicious component can silently install and remove apps, grant permissions and load code sent from a remote server.
The researchers say it has deployed at least 32 disguised apps, including fake weather, app-lock, file-manager, icon-tool, OCR and audio-editor tools.
Infected phones can also be turned into residential proxies and used as part of a botnet, including for DDoS attacks.
Bitdefender also found 13 apps on the Google Play Store that carry the same ad-fraud code.
The firm says it remains unclear at what point in the supply chain the malware is being added to the phones, and it has not accused Doogee, Cubot or any other brand of planting it.
Follow us on X, Facebook and Telegram
Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox
 
Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.
Generated Image: Midjourney