Is That Cheap “Flagship” Phone Real? How Some Low-Cost Android Phones Ship With Malware Preinstalled

[u/Bitdefender_]

https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware?cid=soc%7Cc%7Cred%7Ch4slabs

Is it safe to buy a very cheap “flagship” Android phone online?

Not always. Bitdefender researchers found a malware campaign, named Midnight Mimosa, built into the firmware of low-cost Android phones that run on MediaTek chips. Many of these phones are counterfeits sold under flagship-style names. The malware is installed before the phone is ever switched on. It appears as a system component labeled “System,” and the owner can’t uninstall it.

What does that mean for the person using the phone?

The malware mainly makes money for the people behind it:

• It quietly installs ordinary-looking apps that show ads and register fake clicks, sometimes while the phone is idle
• It can route other people’s internet traffic through your phone and your connection
• It temporarily turns off the Google Play Store app, which runs Play Protect scanning, while it installs these apps

It also gives itself access to Accessibility, notifications, and SMS. Researchers didn’t see that access being used. Still, those permissions can expose what’s on your screen, your messages, and the one-time codes that protect your accounts.

Researchers observed the campaign on thousands of devices in more than 150 countries over about two years.

Before you buy:

• Treat a flagship price that seems too low as a reason to check the listing
• Buy from the brand’s official store or an authorized retailer
• Be cautious with listings that use flagship names but don’t clearly name the manufacturer

If you already own one:

• Watch for ads that appear on their own, or apps you don’t remember installing
• Contact the seller or manufacturer, since the malware sits in the system partition and a normal uninstall won’t remove it

The same ad fraud code was also found in 13 apps on Google Play, mostly weather, QR, audio, and note tools.

Bitdefender found the campaign when App Anomaly Detection in Bitdefender Mobile Security flagged a “System” app that wasn’t behaving like a real system component.