Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Summary: Bitdefender is tracking preinstalled Android malware it calls Midnight Mimosa, found in device firmware on MediaTek-based phones across several brands, running with system-level privileges as "com.android.system.lite". The malware fetches remote configuration, installs or removes at least 32 disguised apps, grants itself accessibility, notification and SMS permissions, and turns infected devices into residential-proxy relay nodes, with most infections in Mexico and the campaign seen on thousands of devices across more than 150 countries over roughly two years.
Why it matters: The root component ships in the system partition, so owners cannot uninstall it by the normal route - Bitdefender says the durable fix sits with the vendors and marketplaces that ship and sell the affected firmware, not with the people holding the phones.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026