Cybersecurity specialists at Bitdefender have uncovered a large-scale campaign distributing inexpensive Android smartphones with pre-installed malware. Dangerous programs are embedded directly into the devices' firmware even before they are sold, so a buyer can receive an infected phone right out of the box. Among the affected models are Doogee S200 X and Cubot KINGKONG X, which are available on Russian marketplaces. However, the presence of a model for sale does not mean that every unit is infected.
The malware, dubbed Midnight Mimosa, masquerades as an Android system component and possesses elevated access privileges. It can covertly install additional applications, manage permissions, and download program code from remote servers. Furthermore, it is virtually impossible to remove using standard means, as the operating system perceives the program as its own component.
Infected smartphones can be used to inflate ad views and clicks, and also turn into botnet nodes for relaying other people's internet traffic. Such networks could potentially be used for DDoS attacks. In addition, the malware can obtain permissions to access SMS, notifications, and other device functions, although researchers have not confirmed the use of these capabilities for data interception.
According to Bitdefender, infected devices have been found in over 150 countries. The problem primarily affects inexpensive smartphones with MediaTek processors. In addition to Doogee and Cubot, malicious components were detected in counterfeit devices posing as flagship Samsung and iPhone models. The highest number of infections was recorded in Mexico, France, Italy, and the USA.
A particular danger is the difficulty of removing the malware. A factory reset does not solve the problem, as the program resides in the system firmware. Cleaning the device may require installing verified software from the manufacturer or disabling dangerous components via a special ADB tool. Experts recommend that owners of affected models check for patches and seek assistance from the manufacturer or seller.