Cheap Android smartphones are leaving the factory with malicious software baked into the device firmware itself, according to research from Bitdefender reported by The Hacker News. The vendor is tracking the campaign as Midnight Mimosa, and says it affects handsets built on MediaTek platforms across several brands.
Because the malicious components are part of the factory system image, the compromise predates the first boot. It also survives the step most consumers would reach for: a factory reset simply reinstalls the infected image, restoring the malware along with everything else.
What the malware reportedly does
The preinstalled software hands operators a small but useful toolkit on compromised devices, according to Bitdefender's findings as relayed by The Hacker News:
- Silent app installation — pushing additional software onto the handset without user consent or visibility.
- Ad fraud — generating fraudulent impressions or clicks in the background.
- Residential proxying — renting out the device's network connection so third parties can route traffic through it, hiding behind an ordinary consumer IP address.
That last capability is the one enterprise security teams should care about most. A handset quietly operating as a proxy exit node can relay credential-stuffing runs, scrape protected services, or carry other malicious traffic from what looks like a routine residential connection — originating from the network of whichever organisation issued or permitted the device.
The published summary of the research does not name affected brands or list specific indicators of compromise. Organisations looking to hunt for the malware should go to Bitdefender's primary advisory for confirmed artefacts and signatures rather than working from secondary coverage.
Why this matters beyond individual consumers
For individual buyers, the obvious lesson is that a suspiciously cheap handset carries risk beyond build quality. The operational concern, though, sits with organisations. Any business that fields low-cost handsets as fleet devices, allows personal phones onto corporate networks under bring-your-own-device policies, or buys budget hardware for field staff may already be running compromised endpoints that show nothing unusual in device management consoles.
This is a supply-chain failure, not a hygiene failure. Mobile device management platforms, app allowlists, and endpoint controls all rest on the assumption that the operating system image beneath them is trustworthy. When that assumption breaks — when the platform layer itself is subverted — those controls can be undermined from below. App-level scanning alone cannot see it.
Organisations in Hong Kong and the Greater Bay Area running distributed workforces, tight procurement budgets, or mixed BYOD fleets face the same structural exposure as any other market: budget handset purchasing and permissive device policies can quietly admit firmware-level compromise past the perimeter. The exposure and the mitigation are both jurisdiction-neutral.
Practical steps for defenders
Security and procurement teams can work from this checklist, drawn from the characteristics of this class of compromise:
- Verify provenance before purchase. Favour devices from established channels with traceable firmware provenance. Avoid unbranded or grey-market handsets where the supply chain cannot be reconstructed.
- Maintain a fleet inventory. Know exactly which models and chipset platforms are deployed, including personal devices permitted on the network.
- Monitor for anomalous behaviour. Watch for unexpected background connections, unidentified processes generating traffic, and devices talking to unfamiliar proxy or ad-tech infrastructure.
- Contain rather than "clean." Where firmware compromise is suspected, wiping the device does not restore trust. Reimaging from a verified, vendor-signed firmware image — or retiring the hardware outright — is the defensible response.
- Update procurement criteria. Treat firmware integrity and supply-chain transparency as evaluation criteria for mobile hardware, not just price and specifications.
The Hacker News coverage summarises the Bitdefender research; organisations after detection guidance should treat the vendor's primary report as the authoritative reference.
多款廉價 Android 智能手機被發現出廠時即在韌體中嵌入惡意軟件，根據 Bitdefender 的研究，並由 The Hacker News 報導。該公司將此攻擊活動命名為 Midnight Mimosa，受影響的裝置採用 MediaTek 平台，橫跨多個品牌。
由於惡意組件屬出廠系統映像的一部分，感染在裝置首次開機前已存在。這亦意味著大部分消費者會嘗試的補救方法並不可行：出廠重設只會重新安裝受感染的映像，惡意軟件隨之復原。
惡意軟件據報具備的能力
根據 The Hacker News 轉述的 Bitdefender 研究結果，預裝軟件讓操控者可在受感染裝置上執行以下操作：
- 靜默安裝應用程式 — 未經用戶同意或察覺，向手機推送額外軟件。
- 廣告詐欺 — 在背景生成虛假的廣告曝光或點擊。
- 住宅代理（residential proxying） — 將裝置的網絡連接出租，讓第三方透過它轉發流量，藏身於一般住宅 IP 地址背後。
最後一項能力最值得企業安全團隊關注。一部手機若在暗中充當代理出口節點，可被用來轉發撞庫（credential-stuffing）攻擊、抓取受保護的服務，或載運其他惡意流量——而其網絡出口看似來自普通住宅連線，實際上卻源自負責配發或批准該裝置的機構網絡。
已公開的研究摘要並未列出受影響的品牌，亦沒有提供具體的入侵指標（IOC）。希望追查此惡意軟件的機構應直接查閱 Bitdefender 的主要通報以取得確認的 artefacts 及特徵碼，而非依賴二手報道。
為何這不只關乎個人消費者
對個人買家而言，最直接的教訓是過分便宜的手機，風險遠不止於造工質素。但營運層面的憂慮其實落在機構身上。任何以廉價手機作流動裝置、容許個人手機在企業政策下接入公司網絡，或為外勤人員採購廉價硬件的企業，可能早已在設備管理後台毫無異常顯示的情況下，運行著受感染的終端。
這是一次供應鏈失誤，而非衛生問題。流動裝置管理（MDM）平台、應用程式白名單及端點控制，全部建立在「其下的作業系統映像可信」這個假設之上。當這假設失效——當平台層本身被挾持——這些控制便可能由下而上被繞過。單靠應用層掃描無法發現這類入侵。
在香港及大灣區運作流動工作團隊、採購預算緊絀或混合 BYOD 裝置群組的機構，面對的結構性風險與其他市場無異：廉價設備的採購及寬鬆的設備政策，可讓韌體層級的入侵悄然越過防線。無論是風險還是應對方法，均不因司法管轄區而異。
防禦方的實務步驟
安全及採購團隊可根據這類入侵的特性，參考以下清單：
- 採購前核實來源。 選擇韌體來源可追溯的正規渠道產品，避免韌體來源無法重建的無品牌或水貨手機。
- 維持裝置清單。 清楚掌握已部署的手機型號及晶片平台，包括獲准接入網絡的個人裝置。
- 監察異常行為。 留意意料之外的背景連接、產生流量的不明進程，以及裝置與陌生代理或廣告科技（ad-tech）基礎設施的通訊。
- 隔離而非「清理」。 一旦懷疑韌體被入侵，清除裝置並不能恢復信任。應從經核實及廠商簽名的韌體映像重新刷入系統，或直接淘汰該硬件。
- 更新採購準則。 將韌體完整性及供應鏈透明度列為流動硬件的評估條件，而非只看價格及規格。
The Hacker News 的報道概述了 Bitdefender 的研究；需要檢測指引的機構應以該公司原始報告為權威參考。