Low-cost Android phones ship with residential proxy malware

A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones, where malicious software is embedded directly into the firmware of devices using MediaTek chipsets. The malware, which operates with system-level privileges, enables silent app installation, ad fraud via fake utility apps, and turns infected devices into residential proxies. The campaign has affected thousands of devices across over 150 countries, with notable impact in Mexico, France, Italy, and the U.S., and persists through preinstalled system apps that cannot be uninstalled normally.

AI-extracted · verify before operational use