Bitdefender Finds Preinstalled Ad Fraud Malware on Off-Brand Android Phones Worldwide

Preinstalled Malware on Off-Brand Phones

Bitdefender researchers have uncovered a massive ad fraud campaign involving preinstalled malware on thousands of off-brand Android phones across more than 150 countries. The operation, dubbed Midnight Mimosa, affects dozens of phone brands. Mexico, France, and Italy lead the geographic distribution, followed by the United States, Germany, Brazil, and Spain.

The malware runs with system-level privileges, so most owners cannot remove it through normal means. Operators use it to install and remove other apps, grant permissions, and load arbitrary code, pulling infected devices into ad fraud, residential proxy botnets, and potentially DDoS attacks.

How the Fraud Works

The malware drops cover apps that appear ordinary, such as weather, app-lock, note, and OCR applications. Each carries a legitimate advertising SDK, which is what the ad network sees and credits for impressions and clicks. Bitdefender identified at least 32 unique disguised payload apps. The malware executes remotely supplied code to fabricate impressions and clicks in the background, while the cover app receives the payment and users see nothing. The malware also disables Google Play Store protections during installation or uninstallation and reenables them afterward.

Counterfeit Devices and Google Play

Many affected models are counterfeit, including fake iPhones like "i17 Pro Max" and an "iPadAirPro" tablet, plus copied Samsung Galaxy strings such as "S25 Ultra" and "Note 18 Ultra". Over 11% of compromised devices present themselves as "KINGKONG X", associated with Cubot, and over 4% as "S200 X", linked to Doogee, though the top 15 brands accounted for only 35.8% of unique infected devices. The malicious app is platform-signed by Shenzhen Zediel Co., Ltd., a real Shenzhen-based Android OEM and tablet maker, and hides under system package names such as com.android.system.lite. Bitdefender also found 13 apps on Google Play carrying the same malicious code, including weather and QR scanner apps, so the campaign is not confined to counterfeit hardware.

Removal and Risks

Because the root component ships in the system partition, clearing the device requires firmware-level cleanup or disabling the component over ADB, neither of which is realistic for most owners. Researchers warn that some sellers lure buyers with cheap hardware and then load it with software that generates revenue afterward. Users should avoid banking, authenticating to sensitive accounts, or storing important data on such devices. Scanning the phone with mobile security software may help detect the compromise, and owners should contact the seller or manufacturer for a replacement.

Sources: Cybernews