Preinstalled malware on budget Android smartphones is emerging as a significant security threat, according to a recent report by Bitdefender. These low-cost devices are equipped with malicious software embedded within their firmware, enabling cybercriminals to install unauthorized applications, commit ad fraud, and transform the devices into residential proxies.
Malware’s Infiltration and Operation
Identified as Midnight Mimosa by Bitdefender, the malware primarily affects Android devices using MediaTek platforms across various brands. This malicious software, known as “com.android.system.lite,” operates with system-level privileges. It can install or remove a rotating selection of at least 32 disguised apps, granting itself additional permissions for accessibility services, notifications, and SMS. The malware also executes external code supplied by its operators.
The malware retrieves a remote configuration from an external server, subsequently downloading and executing payloads designed for ad fraud and silent app installations or removals. These applications can incorporate proxyware, ad fraud, and code execution capabilities, essentially turning affected devices into botnet nodes.
Implications and Monetization Strategies
The primary objective of this scheme appears to be revenue generation through ad and click fraud. The malware facilitates this by installing dropper apps that mimic harmless utility apps. These apps, using a legitimate advertising software development kit (SDK), load genuine ads in an invisible window over other applications.
Bitdefender discovered 13 apps on Google Play linked to the same servers controlling the malware, indicating that the campaign extends beyond preinstalled software. While these Play Store apps provide functional services like weather updates or QR-code scanning, they also display ads outside the app environment, even when the device is inactive.
Global Impact and Manufacturer Involvement
The malware’s disabling of the Google Play Store app before installing payload apps highlights its sophistication. This tactic likely aims to bypass Play Protect defenses. Notably, the malware has been found on devices with firmware signed by Shenzhen Zediel Co., Ltd, though the company’s involvement is not confirmed.
The preinstalled malware indicates a potential compromise in the device supply chain, with Bitdefender noting infrastructure overlaps with the Android.Phantom malware, identified by Doctor Web in 2026. The malware affects thousands of devices across over 150 countries, with a notable concentration in Mexico, followed by several other nations, suggesting a widespread issue among low-cost, white-label, or counterfeit devices.
Historically, firmware-level backdoors are not unprecedented on Android devices. Similar threats, like the Keenadu malware, have been discovered preinstalled on certain tablet models, primarily for ad fraud purposes.
Challenges and Solutions
Bitdefender emphasizes that preinstalled malware represents a unique threat category. Typical user defenses, such as install prompts and app reviews, are ineffective since the malware is embedded at the firmware level. Removing the threat requires either a firmware-level cleanup or disabling the component via ADB, solutions not feasible for average users. The onus for a long-term solution lies with vendors and marketplaces responsible for distributing the affected firmware.
