Low-cost Android phones ship with residential proxy malware

A malware campaign called 'Midnight Mimosa' has been found pre-installed in the firmware of low-cost Android smartphones. The malware is embedded at the supply chain level, meaning devices arrive compromised before reaching end users. Once active, it allows attackers to silently install additional applications without user knowledge. The campaign also enables ad fraud operations leveraging the infected devices. Additionally, compromised devices are enrolled as residential proxies, routing third-party traffic through victims' internet connections. The stealthy nature of firmware-level embedding makes detection and removal extremely difficult for average users. This represents a significant supply chain security concern for budget Android device consumers.