Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Low-cost Android smartphones are shipping with malicious firmware baked in at the manufacturing or distribution stage, meaning consumers are compromised before they even power on the device. The malware, dubbed Midnight Mimosa, exploits the trusted position of firmware to silently install apps, conduct ad fraud, and enlist devices into residential proxy networks — all without user knowledge or consent. This is a classic supply chain attack where the integrity of the hardware supply chain has been undermined, making traditional endpoint security controls ineffective after the fact. The threat is particularly dangerous because affected users — often those least able to afford premium devices — have no realistic way to detect or remediate the compromise themselves. It underscores that security must be validated at every point in the supply chain, not just at the endpoint.