cross-posted from: https://infosec.pub/post/53450841
Bitdefender finds Midnight Mimosa, preinstalled Android malware on cheap MediaTek phones that fakes ad clicks, drops apps and builds a proxy botnet. Bitdefender researchers discovered a campaign called Midnight Mimosa involving preinstalled Android malware on low-cost phones from different brands that use MediaTek platforms. The malware is built into the device firmware and may be […]
this has been a thing since forever tho. luckily(?) those devices also tend to have easy low level flashing and rooting methods
This is yet another reason why we must own our devices, from the ground up.
I encountered this on a cheap android tv box off Amazon. Found weird apks and after some digging found it emulated a pixel phone and performed fraudulent ad impressions using my home internet after I turned off my TV.
Returned it and reported to Amazon. The listing was gone in a day and reposted the next. 🤷♂️
[…] and may be hidden in different system packages depending on the model. It is already on the phone before the owner turns it on for the first time and cannot be removed.
Does good old Canta still work against these?
It can remove it for the current user. But, since the malware is embedded in the firmware it may get re-installed under a different name.
Is this included in HAD already?
How can I scan the phone for this? Especially the models they claim come pre installed to its firmware with it?
