Low-cost Android phones ship with residential proxy malware

The 'Midnight Mimosa' campaign demonstrates a critical supply chain attack where malware is embedded directly into device firmware before it ever reaches the consumer, making traditional endpoint defenses ineffective. Because the malware operates at the system level with elevated privileges, it can silently install applications, conduct ad fraud, and enlist devices into residential proxy networks without any user interaction. This attack persisted undetected for over two years across thousands of devices globally, underscoring how deeply compromised hardware can evade conventional security tooling. The root issue lies in insufficient security vetting of firmware and software components by manufacturers and distributors of low-cost Android devices. This matters because consumers and organizations deploying budget devices have no reasonable expectation that the hardware itself is the threat vector.