Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Low-cost Android smartphones built on MediaTek platforms are being shipped with malware pre-installed in the device firmware. The campaign, tracked by Bitdefender as 'Midnight Mimosa', affects multiple brands and allows threat actors to covertly install applications, conduct advertising fraud, and convert infected devices into residential proxies. The malware is embedded at the firmware level, making it difficult to detect or remove through standard means. The activity targets budget Android devices across several manufacturers. This supply-chain-style attack raises significant concerns about the security of low-cost Android hardware and the integrity of device firmware from certain suppliers.