Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Cheap Android Handsets Arrive Pre-Infected, Research Finds

Bitdefender Labs has identified a malware campaign, tracked as "Midnight Mimosa," built directly into the firmware of low-cost Android smartphones running on MediaTek chipsets. Unlike malicious apps a user installs by mistake, this malware ships from the factory as a platform-signed system component, giving it elevated privileges that let it silently install additional payloads, enroll devices as residential-proxy nodes, and run ad-fraud operations — all without the ability for a typical owner to uninstall it through normal means. Bitdefender says the campaign has been running for roughly two years and has touched thousands of unique devices across more than 150 countries, with the heaviest concentrations in Mexico, France, Italy, and the United States.

Incident Details

What Happened

Bitdefender's App Anomaly Detection technology flagged a system package behaving unlike a normal Android component, which led researchers to a malicious framework baked directly into device firmware — most visibly under the package name com.android.system.lite, alongside related components such as com.android.sys.prot and com.android.sys.gmsprot. Because these components ship with platform signing and system-level privileges, they are treated by Android as trusted parts of the operating system rather than removable third-party apps.

After first boot, a native library inside the component decrypts and loads an embedded framework that reaches out to a command-and-control server disguised as a weather API to pull configuration data and additional modules. To install payloads without tripping Google Play Protect, the malware temporarily disables the Google Play Store, silently installs a disguised app and grants it sensitive permissions (accessibility services, notifications, SMS), and then re-enables the Play Store to mask the activity. Bitdefender found the payloads rotate frequently — researchers catalogued at least 32 distinct disguised apps mimicking weather utilities, AppLock tools, file managers, OCR scanners, icon customizers, and audio editors, with hashes and visual artifacts changed regularly to dodge detection. A related set of 13 apps on Google Play were found communicating with the same command-and-control infrastructure, though without the firmware component's elevated system privileges.

Once installed, the payloads serve two main purposes: covert ad and click fraud, and converting the device into a residential-proxy relay node — effectively making the phone part of a botnet that can be rented out to route traffic through what looks like an ordinary home internet connection. Bitdefender notes this also means infected devices could, in principle, be leveraged for DDoS activity as part of that botnet infrastructure.

A platform certificate associated with one of the malicious packages traces to Shenzhen Zediel Co., Ltd., though Bitdefender was careful to clarify this does not prove the company knowingly inserted or distributed the malware — the exact point of insertion in the supply chain, the full list of affected device models, and any vendor-side fix remain unestablished as of publication.

Because the malware lives in the system partition, affected users cannot remove it through a standard app uninstall, and Bitdefender says any real fix has to come from device vendors and the marketplaces selling the affected firmware — options largely out of reach for individual owners of these devices.

Why This Matters

1. Firmware-level compromise defeats normal defenses. Mobile security advice almost always assumes malicious code arrives as an installable app; a platform-signed system component sidesteps app-store vetting, Play Protect, and ordinary uninstall paths entirely.
2. "Too cheap to be safe" is a real signal. Budget and counterfeit devices — particularly unbranded or grey-market phones mimicking flagship models — carry supply-chain risk that doesn't show up in a spec sheet or price comparison.
3. Residential proxy botnets complicate attribution everywhere else. Traffic relayed through an infected consumer device looks like ordinary home broadband, letting other attackers mask credential-stuffing, fraud, or scraping behind what appears to be legitimate residential IP space — a problem that ripples far beyond the phone's owner.
4. Two years of activity before detection. The length of this campaign underscores how little visibility defenders — and users — have into what ships inside consumer device firmware, especially outside major, well-audited brands.
5. MSPs and IT admins should flag device provenance in BYOD and resale programs. Organizations with bring-your-own-device policies, or that purchase budget hardware for low-priority use cases, should treat unbranded/off-brand Android handsets as a supply-chain risk category worth explicit policy coverage.

Sources

• The Hacker News — Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
• BleepingComputer — Low-cost Android phones ship with residential proxy malware
• Security Affairs — Bitdefender finds preinstalled Android malware you can't uninstall, seen in 150 countries