[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJJiRTQ3yKAy9qMqvkeih21lXFPxkwCgdQquIpu318Kk":3},{"article":4,"iocs":43,"watch_terms":47,"solutions":48,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"797dd721-c03c-453c-a63f-24e979a69086","Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies","low-cost-android-phones-ship-with-preinstalled-malware-that-turns-them-into-resi-563584","Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa. The preinstalled","Malicious software has been preinstalled in the firmware of low-cost Android smartphones, particularly those built on MediaTek platforms. This malware, tracked by Bitdefender as Midnight Mimosa, enables threat actors to covertly install apps, commit ad fraud, and transform the devices into residential proxies.","Low-cost Android phones ship with preinstalled malware turning them into residential proxies.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Flow-cost-android-phones-ship-with.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjWazS9FTiMttWg9JuwySbOkXe9WBGk6EnDbYXfmFzGaoTsXD3FQKLo7YxjnYk9MIZlfmdt08nW3qRKbLggGv2H7ondflK4CbpXu98CiCxnccJfwnrvUwEhMVIHUdt7GO198VkHXASs12AKWj4r44vpT5mF5BHLqX9spJT24dZmpMGqOKyuqoh25f1UuqpY\u002Fs1600\u002Fandroid-malware.jpg","2026-10-13T06:00:11+00:00","2026-10-13T08:00:12.187035+00:00",8,[17,20,22],{"name":18,"type":19},"Android","technology",{"name":21,"type":19},"MediaTek",{"name":23,"type":24},"Bitdefender","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44],{"type":29,"value":45,"context":46},"Midnight Mimosa","Malware campaign name identified by Bitdefender",[23],{"controls":49,"vendors":124},[50,78,99],{"slug":51,"name":52,"problem":53,"products":54},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[55,62,70],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":57,"url":60,"description":61},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":79,"name":80,"problem":81,"products":82},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[83,91],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":42,"name":100,"problem":101,"products":102},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[103,111,116],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":112,"product_name":113,"url":114,"description":115},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[125],{"slug":126,"name":23,"logo_path":127,"roles":128},"bitdefender","\u002Fvendor-logos\u002Fbitdefender.png",[129],"reported_by",{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":145},"preinstalled-malware-on-budget-android-phones-turns-devices-into-proxy-bots","Preinstalled Malware on Budget Android Phones Turns Devices Into Proxy Bots","Low-cost Android smartphones are shipping with malicious firmware baked in at the manufacturing or distribution stage, meaning consumers are compromised before they even power on the device. The malware, dubbed Midnight Mimosa, exploits the trusted position of firmware to silently install apps, conduct ad fraud, and enlist devices into residential proxy networks — all without user knowledge or consent. This is a classic supply chain attack where the integrity of the hardware supply chain has been undermined, making traditional endpoint security controls ineffective after the fact. The threat is particularly dangerous because affected users — often those least able to afford premium devices — have no realistic way to detect or remediate the compromise themselves. It underscores that security must be validated at every point in the supply chain, not just at the endpoint.",[135,136,137,138,139,140,141,142,143,144],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 3: Data Protection","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-124: Guidelines for Managing Mobile Device Security","NIST CSF DE.CM-7: Monitoring for Unauthorized Activity","NIST SR-3: Supply Chain Controls and Processes","GDPR Article 32: Security of Processing (for organizations handling EU personal data via affected devices)","ISO\u002FIEC 27036: Information Security for Supplier Relationships","ITIL: Service Configuration Management (hardware baseline integrity)",{}]