Hackers Turn Low-Cost Android Phones Into Hidden Proxy Botnets Through Preinstalled Malware

Midnight Mimosa, a widespread Android malware campaign, is turning inexpensive smartphones into advertising fraud engines and potential residential proxy nodes by embedding malicious apps in device firmware before purchase.

Bitdefender observed thousands of infected devices across more than 150 countries over approximately two years, exposing a persistent compromise that ordinary application removal cannot resolve.

The affected ecosystem includes low-cost, MediaTek-based handsets and counterfeit flagship models.

Unlike conventional Android infections requiring users to install malicious software, this campaign begins with a platform-signed system application already present when the device reaches its owner.

The initially identified enabler, com.android.system.lite, impersonates an operating system component while retaining powerful permissions, including INSTALL_PACKAGES, DELETE_PACKAGES, GRANT_RUNTIME_PERMISSIONS, and WRITE_SECURE_SETTINGS.

These privileges allow it to install applications, remove packages, grant permissions, and alter protected settings without user interaction.

Its concealed functionality resides in libeasy.so, a native library that uses RC4 to decrypt an embedded Java framework.

That framework retrieves remote configuration and downloads DEX/JAR plugins, allowing operators to change functionality without replacing the original firmware implant.

Command infrastructure includes api.weatherlive.world, while additional modules are retrieved through infrastructure including oss.showtimetool.com.

The weather-themed naming helps the malicious activity resemble routine application communications.

Before deploying payloads, the enabler temporarily turns off the Google Play Store package, then restores it. Bitdefender assesses this behavior as an attempt to evade Play Protect detection.

Sensitive access mechanisms also exist, although researchers did not observe abuse of the associated permissions.

The plugin com.wz.sdk.DxFactory drives fraudulent advertising activity, while com.earnsdk.lib.DxFactory and com.gogo.third.lib.DxFactory support silent application installation and removal.

Hidden windows and automated interactions fabricate impressions, clicks, and conversion events attributed to seemingly legitimate utilities.

Android malware campaign

Researchers identified at least 32 disguised applications across the payload ecosystem, including weather tools, application lockers, OCR utilities, and file managers.

Polyswarm Researchers also found, applications claiming Google Play installation provenance despite lacking the corresponding Play-applied signature block.

Separately, 13 related applications distributed through Google Play carried matching advertising fraud markers and shared infrastructure, but lacked the firmware enabler’s system-level privileges.

One deployed package, com.mobile.applock.en, contains EnLoaderLib proxyware capable of registering devices and establishing bidirectional TCP tunnels access.

This functionality could let third parties route traffic through victims’ internet connections, concealing the originating infrastructure behind residential addresses.

However, capability should not be confused with observed exploitation. Bitdefender’s documented dynamic test did not capture actual traffic relaying, and an initially identified control endpoint was subsequently determined to be a sinkhole.

Mexico, France, and Italy recorded the highest observed concentrations, followed by the United States, Germany, Brazil, and Spain. These findings describe telemetry distribution, not confirmed geographic targeting.

Some firmware certificates contained identifiers associated with Shenzhen Zediel Co., Ltd., but researchers could not establish where the compromise entered the supply chain or implicate the certificate owner.

Code and infrastructure overlaps with Android.Joker, Android.Phantom, and Android.Click likewise do not establish common ownership.

The campaign parallels the broader preinstalled-malware threat highlighted in the FBI’s BADBOX 2.0 warning, without establishing a direct operational connection.

For enterprises, inexpensive procurement and unmanaged BYOD devices create exposure to unauthorized network activity.

Firmware-level persistence makes removing visible payloads insufficient: the privileged enabler can remain available to install replacements and retrieve new remotely supplied code.

Trusted firmware remediation or hardware replacement therefore requires careful assessment rather than reliance on ordinary uninstall workflows alone.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.