Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries

The Midnight Mimosa campaign exposes a critical supply chain vulnerability where malware is embedded directly into device firmware before the hardware ever reaches consumers, making traditional endpoint security tools ineffective. Because the malware operates at the system level, it persists across factory resets and cannot be removed by standard user actions. This attack leverages the often-unregulated manufacturing pipeline of low-cost Android devices built on MediaTek platforms, where firmware integrity verification is rarely enforced. The scale — over 150 countries — demonstrates how a single point of compromise in the supply chain can produce a globally distributed botnet with minimal ongoing effort from attackers. It matters because consumers and organizations deploying budget devices have virtually no visibility into or recourse against firmware-level threats without rigorous pre-deployment vetting.