Loading story…
Bitdefender identified Midnight Mimosa, a campaign involving malware preinstalled in the firmware of thousands of inexpensive Android phones sold worldwide, leaving devices compromised before users first turned them on. Running with system-level privileges, the malware installs applications that generate fraudulent advertising impressions and automated clicks. It also collects device information and includes capabilities that could support botnet participation. Researchers detected affected devices in more than 150 countries over roughly two years.
The investigation also identified 13 Google Play apps that shared infrastructure and ad-fraud code with the campaign, connecting the firmware-based operation to applications distributed through Google's marketplace. The point at which the devices were compromised in the supply chain remains unknown. Although firmware certificates bore Shenzhen Zediel's name, that evidence does not establish that the company created or knowingly distributed the malware. The findings highlight a procurement risk: affected phones arrive with system-level malware already embedded, rather than becoming infected solely through user-installed applications.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Bitdefender corrected its initial identification of 85.17.70.38:6000 as a live proxyware command server, identifying it instead as a sinkhole. The address is therefore not confirmed attacker-controlled infrastructure.
Bitdefender identified com.mobile.applock.en as a dedicated TCP proxy that enrolls infected phones as relay nodes without advertisements or a user interface. The payload connects over TCP port 6000, rotates among four domains, and forwards traffic between its controller and server-designated targets.
Bitdefender reported that Midnight Mimosa temporarily disables Google Play during payload installations, suppressing installation prompts and blinding Play Protect before re-enabling Google Play. Its report also includes an extensive list of indicators of compromise.
Bitdefender identified 13 Google Play applications sharing infrastructure and ad-fraud code with the campaign. These apps provided genuine utility functions but could display advertisements outside their interfaces, without the firmware malware's system-level privileges.
Over roughly two years, Bitdefender detected the campaign on thousands of devices across more than 150 countries and identified at least 32 disguised payload applications. Researchers disclosed that the preinstalled malware could install or remove apps, grant permissions, and download and execute additional code; its supply-chain entry point remained unknown.
Phones from multiple brands using MediaTek chips were sold with malicious software already embedded in their firmware. The system-privileged malware silently installed utility-style applications that generated fraudulent advertising impressions and automated clicks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 146 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
9 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcesecurityweek.com
Open sourcehackread.com
Open sourcetherecord.media
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that a significant share of Android infections stemmed from malware and adware embedded in the **system partition** or shipped in device firmware, particularly on low-cost smartphones and tablets. Because these components reside in protected system areas, they are difficult to remove without reflashing the device and can survive normal cleanup efforts. The report said **14.8%** of users hit by malware or adware over the prior year had infections in the system partition, with prevalence reaching **27%** for some budget vendors. Researchers identified two main infection paths: malware that gains root access and installs itself into system directories, and ad-related code inserted into firmware before devices are sold. Threats observed included **Triada**, **Lezok**, **Agent.pe**, **Sivu.c**, **Plague.f**, **Agent.pac**, **Penguin.e**, **Necro.d**, **Facmod.a**, **Guerrilla.i**, **Virtualinst.c**, and **Secretad.c**, which were linked to silent app installation, intrusive advertising, code downloading, and remote control capabilities. The report also highlighted adware-like behavior in some **Meizu** apps and the widespread presence of the `/bin/fotabinder` binary, which could download and execute code from remote servers, underscoring supply-chain security risks in budget Android devices.
Aug 14, 2026
Researchers reported a large Android supply-chain compromise in which devices from more than 50 brands were shipped with malware embedded in firmware, allowing attackers to control phones before users installed any apps. Trend Micro said the operation, attributed to **Lemon Group**, implanted **Guerrilla** malware through a tampered zygote-related library and used a core plugin called **Sloth** to fetch modules for SMS interception, proxying, cookie theft, WhatsApp abuse, ad fraud, and silent app installation. Telemetry and actor-hosted data indicated activity across more than 180 countries, hundreds of thousands of mobile numbers used for OTP requests, and millions of potentially affected devices, with the business later rebranded in part from Lemon SMS to Durian Cloud SMS while keeping backend infrastructure. The findings echo earlier reporting on **Triada**, an Android malware family that evolved from a rooting trojan into a preinstalled system-image backdoor embedded in framework components. Google previously said Triada abused privileged contexts such as **System UI** and **Google Play** to execute code, monitor foreground apps, replace ads, and install applications so they appeared to come from Google Play, and that infections were inserted into device images during production by a third party using the names **Yehuo** or **Blazefire**. Trend Micro said the newer Guerrilla campaign showed infrastructure overlap with Triada operators, suggesting a continuing ecosystem of firmware-level Android compromise monetized through fraud, silent installs, and persistent device backdoors.
Aug 21, 2026
Researchers at Zimperium’s zLabs uncovered a large Android malware campaign that used nearly 250 malicious apps to silently subscribe victims to premium carrier-billing services and abuse premium SMS flows without consent. The apps impersonated well-known brands and games including **Facebook Messenger**, **Instagram Threads**, **TikTok**, **Minecraft**, and **Grand Theft Auto**, and targeted users in **Malaysia, Thailand, Romania, and Croatia**. The operation was active from March 2025 through January 2026, with some attacker infrastructure still online at the time of reporting. zLabs identified three malware variants that activated only when a device’s SIM matched specific mobile operators, helping the fraud remain hidden from non-targeted users by showing benign fallback pages. The malware used hidden WebViews and JavaScript to automate subscription pages, intercepted one-time passwords through Google’s SMS Retriever API, disabled Wi‑Fi to force cellular billing, stole cookies, sent delayed premium SMS messages, and reported activity through attacker-controlled Telegram channels. Researchers said the infrastructure supported command-and-control, victim tracking, analytics, and exfiltration of device metadata and billing-page content.
Jun 29, 2026