Midnight Mimosa Malware Found Preinstalled on Low-Cost Android Phones
Bitdefender researchers uncover Midnight Mimosa malware preinstalled on low-cost MediaTek Android phones enabling ad fraud and proxyware activity.
Cybersecurity researchers at Bitdefender have identified a campaign dubbed Midnight Mimosa affecting multiple low-cost Android phone brands built on MediaTek platforms, allowing operators to install apps, grant permissions and load code without the owner’s consent.
The infection happens below the normal app-installation layer. In its research shared with Hackread.com, Bitdefender notes that “every user-facing defense had already been bypassed” by the time the phone was switched on.
Malware Hidden as a System Component
The malware hides in system packages such as com.android.system.lite and com.android.sys.prot. Because they run with Android system privileges, users cannot normally remove them.
A native library called libeasy.so decrypts another component and connects to api.weatherlive.world to download more code. The malware can then install or remove apps without asking the user and give those apps additional permissions.
Bitdefender also...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
