Low-cost Android phones ship with residential proxy malware

The 'Midnight Mimosa' malware campaign targets low-cost Android smartphones by embedding malicious software within the device firmware. This embedded malware allows attackers to perform unauthorized actions such as silent app installations, ad fraud activities, and transforming the infected devices into residential proxies for potentially malicious network traffic routing.

Affected devices can be exploited to install apps without user knowledge, generate fraudulent advertising revenue, and be used as residential proxies, which may facilitate further malicious activities such as anonymizing attacker traffic or conducting other network-based attacks.

No specific patch or remediation details are provided. Users of affected low-cost Android devices should consider replacing the device or reflashing with trusted firmware if possible. Monitoring for unusual device behavior and avoiding purchasing devices from untrusted sources may reduce risk. Patch status is not yet confirmed — check vendor advisories or device manufacturer communications for updates.