[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7m-PuM8GzScCd4DrDtczDj6Ikq14wynEDcReWAW6H_k":3},{"article":4,"iocs":51,"watch_terms":61,"solutions":62,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"d48b12fe-421e-417d-a0b8-13376a2ad8a9","Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries","pre-baked-firmware-malware-hits-budget-android-devices-in-150-countries-04744a","Midnight Mimosa is the name given to a malware campaign primarily running preinstalled on low-cost Android devices. The post Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries appeared first on SecurityWeek.","Midnight Mimosa is a large-scale malware campaign discovered by Bitdefender that primarily targets low-cost Android devices built on MediaTek platforms by preinstalling malware in device firmware. The persistent system-level malware enables ad fraud, click fraud, and botnet deployment across thousands of devices in over 150 countries, with no single geographic concentration. The campaign also leverages 13 associated Google Play Store apps as an additional distribution vector.","Midnight Mimosa malware campaign preinstalls on budget Android devices across 150+ countries via firmware.","https:\u002F\u002Fwww.securityweek.com\u002Fpre-baked-firmware-malware-hits-budget-android-devices-in-150-countries\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F11\u002Fandroid-banking-malware.png","2026-10-09T09:55:35+00:00","2026-10-09T10:00:27.693707+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"Midnight Mimosa","campaign",{"name":21,"type":22},"Bitdefender","vendor",{"name":24,"type":22},"MediaTek",{"name":26,"type":27},"Android","technology",{"name":29,"type":22},"Google","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,54,58],{"type":34,"value":18,"context":53},"Preinstalled firmware malware targeting budget Android devices; enables ad fraud, click fraud, and botnet operations",{"type":55,"value":56,"context":57},"mitre_attack","T1574.001","DLL Side-Loading \u002F Privilege Escalation via firmware preinstallation",{"type":55,"value":59,"context":60},"T1444","Masquerading via Google Play Store apps with same ad-fraud markers",[29,21,24],{"controls":63,"vendors":141},[64,92,113],{"slug":65,"name":66,"problem":67,"products":68},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[69,77,84],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":79,"url":82,"description":83},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":93,"name":94,"problem":95,"products":96},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[97,105],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":50,"name":114,"problem":115,"products":116},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[142],{"slug":143,"name":21,"logo_path":144,"roles":145},"bitdefender","\u002Fvendor-logos\u002Fbitdefender.png",[146],"reported_by",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":163},"firmware-level-malware-pre-installed-on-budget-android-devices-worldwide","Firmware-Level Malware Pre-Installed on Budget Android Devices Worldwide","The Midnight Mimosa campaign exposes a critical supply chain vulnerability where malware is embedded directly into device firmware before the hardware ever reaches consumers, making traditional endpoint security tools ineffective. Because the malware operates at the system level, it persists across factory resets and cannot be removed by standard user actions. This attack leverages the often-unregulated manufacturing pipeline of low-cost Android devices built on MediaTek platforms, where firmware integrity verification is rarely enforced. The scale — over 150 countries — demonstrates how a single point of compromise in the supply chain can produce a globally distributed botnet with minimal ongoing effort from attackers. It matters because consumers and organizations deploying budget devices have virtually no visibility into or recourse against firmware-level threats without rigorous pre-deployment vetting.",[152,153,154,155,156,157,158,159,160,161,162],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 15: Service Provider Management","CIS Control 18: Penetration Testing","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-124: Guidelines for Managing Mobile Device Security","NIST CSF DE.CM-4: Malicious code is detected","NIST CSF ID.SC-2: Suppliers and third-party partners are identified","NIST IR 8272: Impact Analysis Tool for Interdependencies in Critical Manufacturing","ISO\u002FIEC 27036: Information security for supplier relationships","Android Enterprise Recommended (AER) Program","GDPR Article 32: Security of processing (for EU-deployed devices handling personal data)",{}]