Bitdefender finds firmware malware turning Android phones into proxy relays

Bitdefender identified preinstalled malware on low-cost Android phones that lets operators install and remove apps, grant permissions and execute remotely supplied code. The campaign, called Midnight Mimosa, targets devices built on MediaTek platforms across several brands and uses additional apps for ad fraud and residential proxies that relay traffic through users' devices. The malware temporarily disables Google Play Store before installing payload apps, apparently to bypass Play Protect. Bitdefender also found 13 Google Play apps communicating with the same control servers. Owners cannot remove the firmware component through ordinary uninstall tools. Some affected firmware bears certificates attributed to Shenzhen Zediel, but the manufacturer's involvement or awareness is unclear.