[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMIk85r07n5Ylykc3D-sJ8345a6LaoInjlt2pbKphQgY":3},{"article":4,"iocs":49,"watch_terms":63,"solutions":64,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"c52ee5bc-a8b8-4967-81c4-e6c14049e479","Low-cost Android phones ship with residential proxy malware","low-cost-android-phones-ship-with-residential-proxy-malware-5a6371","A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. [...]","A malware campaign named 'Midnight Mimosa' has been found embedded in the firmware of low-cost Android smartphones, particularly those with MediaTek chipsets. This pre-installed malware grants system-level privileges, allowing attackers to silently install apps, commit ad fraud, and turn devices into residential proxies. The campaign has affected thousands of devices globally over two years, with victims primarily in Mexico, France, Italy, and the US.","Low-cost Android phones are shipping with pre-installed 'Midnight Mimosa' malware.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Flow-cost-android-phones-ship-with-residential-proxy-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2023\u002F05\u002F25\u002FAndroid_malware.jpg","2026-10-08T19:20:33+00:00","2026-10-08T20:00:17.784521+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"Doogee S200 X","product",{"name":21,"type":19},"Cubot KINGKONG X",{"name":23,"type":24},"MediaTek chipsets","technology",{"name":26,"type":27},"Bitdefender","vendor",{"name":29,"type":30},"Midnight Mimosa","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,52,55,58,61],{"type":35,"value":29,"context":51},"Name of the malware campaign",{"type":35,"value":53,"context":54},"com.android.non.szcz","Malware package name associated with the Midnight Mimosa family",{"type":35,"value":56,"context":57},"com.android.system.lite","Suspicious system application flagged by Bitdefender, part of the malware framework",{"type":35,"value":59,"context":60},"com.android.system.prot","Impersonates legitimate Android system package",{"type":35,"value":62,"context":60},"com.android.sys.gmsprot",[26,18,21],{"controls":65,"vendors":144},[66,94,115],{"slug":67,"name":68,"problem":69,"products":70},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[71,79,86],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":81,"url":84,"description":85},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[99,107],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":116,"name":117,"problem":118,"products":119},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",[145],{"slug":146,"name":26,"logo_path":147,"roles":148},"bitdefender","\u002Fvendor-logos\u002Fbitdefender.png",[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":165},"pre-installed-malware-in-low-cost-android-firmware-highlights-supply-chain-risk","Pre-Installed Malware in Low-Cost Android Firmware Highlights Supply Chain Risk","The 'Midnight Mimosa' campaign demonstrates a critical supply chain attack where malware is embedded directly into device firmware before it ever reaches the consumer, making traditional endpoint defenses ineffective. Because the malware operates at the system level with elevated privileges, it can silently install applications, conduct ad fraud, and enlist devices into residential proxy networks without any user interaction. This attack persisted undetected for over two years across thousands of devices globally, underscoring how deeply compromised hardware can evade conventional security tooling. The root issue lies in insufficient security vetting of firmware and software components by manufacturers and distributors of low-cost Android devices. This matters because consumers and organizations deploying budget devices have no reasonable expectation that the hardware itself is the threat vector.",[155,156,157,158,159,160,161,162,163,164],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 3: Data Protection","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-124: Guidelines for Managing Mobile Device Security","NIST SA-12: Supply Chain Protection","NIST SI-7: Software, Firmware, and Information Integrity","GDPR Article 32: Security of Processing (for EU-affected users)","NIST CSF DE.CM-7: Monitoring for Unauthorized Personnel, Connections, Devices, and Software","ISO\u002FIEC 27001 A.15.1: Information Security in Supplier Relationships",{}]