CYBERSECURITYTRACKER
Permanent story citation

Low-cost Android phones ship with residential proxy malware

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 9745

As cited

Copy frozen at (site build).

threat intel

Low-cost Android phones ship with residential proxy malware

A malware campaign called Midnight Mimosa has been found pre-installed in the firmware of budget-priced Android phones. The malware enables attackers to covertly deploy applications, commit ad fraud, and repurpose devices as residential proxies without user knowledge.

Why it matters: Users and IT teams purchasing low-cost Android devices face silent compromise at the firmware level, enabling unauthorized proxy operations and ad fraud that degrade device performance and network integrity.

VendorsGoogle
Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

threat intel

Low-cost Android phones ship with residential proxy malware

A malware campaign called Midnight Mimosa has been found pre-installed in the firmware of budget-priced Android phones. The malware enables attackers to covertly deploy applications, commit ad fraud, and repurpose devices as residential proxies without user knowledge.

Why it matters: Users and IT teams purchasing low-cost Android devices face silent compromise at the firmware level, enabling unauthorized proxy operations and ad fraud that degrade device performance and network integrity.

VendorsGoogle
Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

threat intel

Low-cost Android phones ship with residential proxy malware

A malware campaign called Midnight Mimosa has been found pre-installed in the firmware of budget-priced Android phones. The malware enables attackers to covertly deploy applications, commit ad fraud, and repurpose devices as residential proxies without user knowledge.

Why it matters: Users and IT teams purchasing low-cost Android devices face silent compromise at the firmware level, enabling unauthorized proxy operations and ad fraud that degrade device performance and network integrity.

VendorsGoogle
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary