[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKoTI0OsSyuLqkxGO22y8Oxn1iiGDqFKpRtxQ5aNluPs":3},{"article":4,"iocs":45,"watch_terms":49,"solutions":50,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"2f801b18-00af-48da-9d70-9c50794fc973","Midnight Mimosa Malware Found Preinstalled on Low-Cost Android Phones","midnight-mimosa-malware-found-preinstalled-on-low-cost-android-phones-ca6bcc","Low-cost Android phones can arrive already compromised, with malware embedded in their firmware before buyers switch them on.","Researchers have discovered a new strain of malware, named Midnight Mimosa, that is preinstalled on low-cost Android smartphones. This malware is embedded directly into the device's firmware, meaning it is present before the user even turns the phone on. The implications for user security and privacy are significant, as the malware can potentially steal sensitive data and perform unauthorized actions from the moment the device is activated.","Malware dubbed Midnight Mimosa found preinstalled on low-cost Android phones.","https:\u002F\u002Fhackread.com\u002Fmidnight-mimosa-malware-preinstalled-android-phones\u002F",null,"2026-10-08T15:28:24+00:00","2026-10-08T16:00:08.926323+00:00",8,[17,20],{"name":18,"type":19},"Android phones","product",{"name":21,"type":22},"firmware","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":12,"name":25,"slug":26},"Malware","malware",[28,33,35,40],{"category":29},{"id":30,"icon":12,"name":31,"slug":32},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":34},{"id":23,"icon":12,"name":25,"slug":26},{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":26,"value":47,"context":48},"Midnight Mimosa","Name of the preinstalled malware.",[18],{"controls":51,"vendors":129},[52,80,101],{"slug":53,"name":54,"problem":55,"products":56},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":75,"url":78,"description":79},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":81,"name":82,"problem":83,"products":84},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[85,93],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":44,"name":102,"problem":103,"products":104},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[130],{"slug":131,"name":132,"logo_path":133,"roles":134},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[135],"affected",{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":152},"firmware-level-malware-preinstalled-on-budget-android-devices","Firmware-Level Malware Preinstalled on Budget Android Devices","Midnight Mimosa represents a classic supply chain attack where malicious code is embedded into device firmware before the product ever reaches the consumer, bypassing traditional endpoint security entirely. Because the malware exists at the firmware level, standard antivirus tools and factory resets may be ineffective at removing it. This attack vector is particularly dangerous for cost-conscious consumers and organizations that procure low-cost devices without rigorous hardware vetting. The compromise begins at the moment of activation, giving attackers immediate and persistent access to sensitive data with no user action required.",[141,142,143,144,145,146,147,148,149,150,151],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 15: Service Provider Management","CIS Control 18: Penetration Testing","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-124: Guidelines for Managing Mobile Device Security","NIST CSF DE.CM-4: Malicious code detection","NIST IR 8272: Impact Analysis Tool for Interdependencies in Critical Infrastructure","ISO\u002FIEC 27036: Information Security for Supplier Relationships","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing","Android Enterprise Recommended Requirements",{"CIS Control 18: Penetration Testing":153,"GDPR Article 32: Security of Processing":154,"NIST CSF DE.CM-4: Malicious code detection":155,"Android Enterprise Recommended Requirements":156,"CIS Control 15: Service Provider Management":157,"CIS Control 2: Inventory and Control of Software Assets":158,"NIST SP 800-161: Supply Chain Risk Management Practices":159,"GDPR Article 25: Data Protection by Design and by Default":160,"ISO\u002FIEC 27036: Information Security for Supplier Relationships":161,"NIST SP 800-124: Guidelines for Managing Mobile Device Security":162,"NIST IR 8272: Impact Analysis Tool for Interdependencies in Critical Infrastructure":163},"Penetration testing and device evaluation can uncover preinstalled malware before devices are deployed.","Appropriate security includes using devices from trusted suppliers, as preinstalled malware undermines all other controls.","Malicious code detection at firmware level is needed, since standard antivirus and resets do not remove this malware.","Android Enterprise Recommended devices meet security and update requirements, reducing exposure to compromised budget devices.","Service provider management includes vetting device manufacturers and suppliers for firmware security.","A software inventory, including device firmware, helps identify devices from suppliers linked to Midnight Mimosa.","Supply chain risk management helps avoid buying devices from suppliers that ship compromised firmware.","Data protection by design includes choosing trusted devices for processing personal data.","Supplier relationship security includes requirements for device firmware integrity.","Mobile device security guidance includes vetting devices and using managed, trusted hardware.","Understanding interdependencies helps assess how compromised devices could affect critical services."]