Thousands of Android Phones Ship With Hidden Malware That Disables Google Play Protections

Thousands of Android phones across more than 150 countries have been found running malware planted in their firmware before purchase.

The campaign, called Midnight Mimosa, targets low-cost devices and gives attackers system access without requiring owners to download a harmful app or click a suspicious link.

The malware can secretly install and remove apps, load new code, and generate fake advertising activity. Before installing extra payloads, it temporarily disables the Google Play Store package, then restores it.

Researchers assess this behavior as an attempt to avoid Google Play Protect detection, rather than proof that every protection remains permanently disabled.

Researchers from PolySwarm noted the malware’s firmware-level access in their Midnight Mimosa research report, published October 19.

Their analysis draws on Bitdefender’s investigation, which observed thousands of infected devices over roughly two years.

Mexico, France, and Italy had the highest observed counts, followed by the United States, Germany, Brazil, and Spain. Those figures describe observed infections, not confirmed targeting.

Thousands of Android Phones Ship With Hidden Malware

The infection starts with a malicious system application signed with an Android platform certificate. This trusted position lets it install packages, remove applications, grant permissions, and change protected settings.

Earlier cases of preinstalled Android phone malware show why checking downloaded apps alone cannot address threats already embedded in a device’s software.

The component hides its main functions inside a native library. When loaded, that library uses RC4 encryption to unpack a concealed Java framework.

The framework then contacts command-and-control servers, receives settings, and downloads DEX or JAR plugins. These are Android code modules that let operators change the malware’s behavior without replacing the original system application.

Different plugins handle advertising fraud and silent app installation. Some generate fake ad views, clicks, and conversion events through hidden windows and automated actions.

The activity appears to come from ordinary tools, including weather apps, app lockers, text scanners, and file managers. Bitdefender identified at least 32 disguised applications within the wider payload network.

How the Malware Evades Checks

Temporarily disabling the Play Store creates a window for installing additional software while attempting to avoid detection. Some malicious apps also falsely list Google Play as their installer, despite lacking the signature block applied through Play distribution.

That mismatch can help investigators distinguish a claimed installation source from evidence of how an app actually arrived.

The technique adds detail to earlier Midnight Mimosa firmware findings, which described how the hidden component survives while visible payloads change.

Separately, researchers found 13 related ad-fraud apps distributed through Google Play. These shared malware markers and infrastructure, but did not have the same privileged access as the firmware-installed component.

The enabler also includes functions linked to Accessibility, Notification Access, and SMS permissions, including ways to enable sensitive access automatically.

Researchers did not observe these permissions being used for theft. However, the ability to fetch new code means the campaign’s future behavior cannot be judged only from the advertising modules already examined.

Another payload contains proxy software capable of registering a device and opening two-way TCP tunnels. This could allow outside traffic to pass through an infected phone’s internet connection.

The distinction matters: researchers confirmed the underlying capability, but did not observe actual traffic relaying during their documented test. An initially reported control endpoint was also later identified as a sinkhole.

The wider risk resembles the abuse described in reporting on malicious residential proxy networks, where compromised consumer devices provide network access for other users.

That comparison does not establish a link between operations. For Midnight Mimosa, proxy functionality could expose homes or workplaces to traffic they did not authorize.

Affected devices included inexpensive MediaTek-based phones, counterfeit flagship models, and devices reporting identifiers associated with Doogee and Cubot products.

Some firmware certificates carried identifiers associated with Shenzhen Zediel. Researchers could not determine where the malware entered the supply chain or establish that the certificate owner knowingly participated.

Connections to Joker, Phantom, and Click malware likewise do not prove a shared operator. Removing a visible app may leave the firmware enabler able to install replacements. Cleanup therefore requires attention to the underlying firmware, not just individual payloads.

Google explains that its app safety checks examine applications during installation and scan devices periodically, but this case shows why trusted system components also need scrutiny.

Indicators of compromise (IoCs):-

The source lists these 40 sample hashes. Each is reproduced as published; the report does not map individual hashes to specific packages.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Thousands of Android Phones Ship With Hidden Malware That Disables Google Play Protections appeared first on Cyber Security News.