Low-cost MediaTek Android phones ship with system-level malware turning them into residential proxy nodes

Bitdefender detailed Midnight Mimosa, a campaign in which low-cost Android phones built on MediaTek platforms ship with a preinstalled system component, com.android.system.lite, that runs with system privileges. It grants itself accessibility, notification, and SMS permissions, installs and removes apps silently, performs ad fraud through an invisible overlay, and turns devices into residential proxy relays and botnet nodes. It disables the Play Store while dropping payloads to evade Play Protect. Bitdefender also found 13 related Play Store apps, and most infections are in Mexico, France, and Italy. Because the component sits in the system partition, users cannot remove it without firmware-level intervention.

Check

Avoid low-cost MediaTek Android devices from untrusted brands for sensitive use, and treat preinstalled system apps like com.android.system.lite as uncleanable without firmware reflashing.

Affected

Affected phones carry a system-partition component that silently installs apps, commits ad fraud, and relays residential-proxy and botnet traffic, and it cannot be removed by uninstalling.

Fix

Source Android devices through trusted vendors, reflash or replace compromised firmware, monitor networks for residential-proxy traffic, and remove the 13 related Play Store apps Bitdefender identified.