Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

As cited

Copy frozen at 2026-10-13 09:49 UTC (site build).

threat intel

Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Low-cost Android smartphones with MediaTek processors shipped with preinstalled malware embedded in device firmware, tracked by Bitdefender as Midnight Mimosa. The malware enables attackers to covertly install applications, conduct ad fraud, and repurpose devices as residential proxies.

Why it matters: Users of budget Android devices face compromised devices from the point of sale; practitioners should assess device procurement policies and implement mobile device management (MDM) controls to detect and isolate affected hardware.

Source published

2026-10-13 06:00 UTC

First seen by Cybersecurity Tracker

2026-10-13 09:03 UTC