Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Low-cost Android smartphones, primarily built on MediaTek platforms, have been found shipping with preinstalled malware named 'Midnight Mimosa' by Bitdefender. The malware, disguised as 'com.android.system.lite', runs with system-level privileges and enables remote operators to silently install and uninstall apps, conduct ad fraud, and turn devices into residential proxies. It communicates with external command-and-control servers to download additional payloads and has been linked to at least 13 apps on Google Play that exhibit similar behavior. The campaign has affected thousands of devices across over 150 countries, with a majority located in Mexico, and is believed to stem from a supply chain compromise involving firmware signed by Shenzhen Zediel Co., Ltd.

AI-extracted · verify before operational use