Low-cost Android smartphones shipped with pre-installed Midnight Mimosa proxy malware — 09.10.2026

Bitdefender researchers discovered the Midnight Mimosa campaign, in which malware was pre-installed in the firmware of low-cost Android devices using MediaTek chipsets. With system-level privileges, the malware can install and remove applications, grant sensitive permissions, execute remotely downloaded code, commit advertising fraud, and turn devices into residential proxies. The campaign affected approximately thousands of devices across more than 150 countries over about two years.