thehackernews.com
Oct 13, 2026
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
AI-summarised brief · reviewed before publication
Low‑cost Android phones built on MediaTek platforms have been shipped with a firmware‑level malware dubbed Midnight Mimosa. The malicious component, “com.android.system.lite,” runs with system privileges, enabling the remote installation of at least 32 disguised apps that perform ad fraud, silent app toggling, and proxying. Bitdefender identified the malware on thousands of devices across 150 countries, primarily in Mexico, France, and the U.S., and noted its presence on firmware signed by Shenzhen Zediel Co. The campaign also involves Play Store apps that load hidden ads and disable Play Protect to evade detection.
💡 Why It Matters
- · The preinstalled nature of the malware bypasses all user‑level defenses, turning everyday phones into covert botnet nodes and undermining trust in the Android supply chain.
- · This exposes millions of consumers to hidden surveillance and financial fraud, prompting urgent scrutiny of device manufacturing and firmware integrity.
