Cheap MediaTek-based Android phones reach buyers with ad-fraud malware already in the firmware

No exploit is involved, because the access ships with the hardware ^[2]. "The malware ships preinstalled in the device firmware," Bitdefender said in a report released Thursday. "It's on the phone before the owner switches it on for the first time, and it can't be uninstalled." ^[2]

For now that access is spent on advertising ^[3]. The firmware app does not produce fraudulent ad views itself ^[14]. It plants apps posing as weather, note-taking, app-lock and file-management utilities ^[14]. Those apps load real ads from legitimate ad services into invisible windows over other applications, registering impressions the owner never sees ^[15]. Some components also generate automated clicks ^[15]. Separately, the malware collects information about the device and its installed apps, and Bitdefender found capabilities that could pull infected phones into botnets ^[3]. Because the firmware app can download and run additional code without approval, the operator decides what an infected phone does next ^[4].

App-store scanning arrives too late to catch this ^[2][6]. Bitdefender counted at least 32 disguised payload apps ^[16], and it said the Play Store shutdown during some installs is potentially meant to evade detection ^[6]. The store is also a second channel for the same operation. The 13 Play apps tied to its infrastructure ^[7] lack system privileges and offer real functions such as weather or QR-code scanning ^[9]. They could still show ads outside the apps, the researchers said, including when the owner was not using the phone ^[9].

Midnight Mimosa, as Bitdefender named the campaign, is a sustained operation ^[1]. Bitdefender tracked it for roughly two years; the biggest shares of detected devices were in Mexico, France and Italy, with the United States, Germany, Brazil and Spain next ^[5]. The researchers stated the business model themselves. "The internet is flooded with extremely cheap, and sometimes straight-up counterfeit, Android phones," they said. "One way to make the money back on hardware sold that cheaply is to load it with software that earns afterwards." ^[17]

The common hardware across the affected brands is a MediaTek chip ^[8]. The insertion points Bitdefender named as possible sit later in the chain: an original device manufacturer, a firmware integrator, a logistics partner or another intermediary before sale ^[12]. Certificates used to sign some of the affected firmware carry the name of Shenzhen Zediel, a Chinese maker and seller of smart hardware and consumer electronics ^[11]. According to Bitdefender, those certificates are not proof that the company built the malware, distributed it knowingly or was aware of it ^[11]. The evidence ties the implant to the low-cost, white-label and counterfeit tier of the market ^[13]. It does not show that MediaTek-based phones as a group are compromised ^[8][12].