Midnight Mimosa Malware Preinstalled on Low-Cost Android Phones

A malware campaign named Midnight Mimosa has been found on budget Android smartphones, with malicious software embedded directly in their firmware. This gives attackers system-level privileges to install apps, perform ad fraud, and turn devices into residential proxies. The malware affects thousands of devices across over 150 countries, with significant victims in Mexico, France, Italy, the United States, Germany, Brazil, and Spain. The malware is preinstalled on devices from manufacturers like Doogee and Cubot, as well as impersonated Samsung and Apple products. Users reported suspicious apps that reinstalled themselves after removal, and some manufacturers released firmware updates to resolve the infections without explaining how the malware was introduced.