<![CDATA[Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies]]>

<![CDATA[Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies]]>Low-cost Android smartphones have been found shipping with malicious software embedded directly in the device firmware, according to research from Bitdefender. The campaign, tracked as Midnight Mimosa, targets Android devices built on MediaTek platforms across multiple brands.

Once active, the malware gives attackers the ability to covertly install applications, carry out ad fraud, and quietly turn infected devices into residential proxies. Because the malicious code is baked into the firmware rather than installed as a normal app, it is present from the moment the user first powers on the device.

Key points:

Affected devices are low-cost Android phones built on MediaTek platforms
Multiple brands are impacted, not a single manufacturer
The malware is preinstalled in the firmware, not delivered through user-installed apps
Capabilities include silent app installation, ad fraud, and converting devices into residential proxies
Bitdefender is tracking the activity under the name Midnight Mimosa

The full scope of affected models and brands has not been detailed in the available reporting, and no specific CVE identifiers have been published in connection with this campaign.

Source: The Hacker News

Have you encountered low-cost MediaTek-based Android devices in your environment, and how are you verifying firmware integrity before deployment?

]]>https://xploitlk.com/topic/670/low-cost-android-phones-ship-with-preinstalled-malware-that-turns-them-into-residential-proxiesRSS for NodeTue, 27 Oct 2026 07:22:47 GMTTue, 13 Oct 2026 08:30:34 GMT60