Pre‑installed Residential Proxy Malware Discovered on Low‑Cost Android Phones in 150+ Countries
What Happened — Researchers uncovered a campaign, dubbed Midnight Mimosa, that embeds residential‑proxy malware directly into the firmware of inexpensive Android smartphones using MediaTek chipsets. The malicious code runs with system‑level privileges, silently installs apps, conducts ad‑fraud, and can turn devices into proxy nodes. The infection was observed on thousands of devices across more than 150 countries over a two‑year period.
Why It Matters for Trust & Control Assurance
- Demonstrates a supply‑chain compromise where firmware integrity controls were absent, a scenario continuous control‑assurance programs are built to detect and evidence.
- Highlights the need for third‑party risk management and ongoing firmware‑integrity monitoring to provide defensible audit trails.
- Shows that without verifiable firmware signing and update validation, organizations cannot prove due‑diligence to regulators or partners.
Who Is Affected
- Manufacturers of low‑cost Android devices (e.g., Doogee, Cubot)
- Telecom carriers and resellers that distribute these phones
- End‑users who purchase the devices worldwide
Recommended Actions
- Verify that device firmware is signed with a trusted key and enforce secure update mechanisms.
- Conduct a supply‑chain risk assessment focusing on OEM firmware processes.
- Deploy continuous monitoring for anomalous network traffic or unauthorized app installations on managed devices.
- Collect and retain evidence of firmware integrity checks for audit readiness.
Source: BleepingComputer
Technical Notes
- Malware resides in the system partition, using package names such as
com.android.system.liteandcom.android.sys.prot. - It leverages MediaTek chipset privileges to bypass normal uninstall mechanisms.
- The campaign enables ad‑fraud and turns devices into residential proxies, facilitating illicit traffic routing.
Source: Bitdefender research cited in the article