[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSwEdKdasIwHmjHPdRzcRUIlmluhAf19qW6GzXcXJ4Sc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"1114e34d-7158-493d-938a-96644304c63b","preinstalled-malware-on-budget-android-phones-turns-devices-into-proxy-bots","797dd721-c03c-453c-a63f-24e979a69086","Preinstalled Malware on Budget Android Phones Turns Devices Into Proxy Bots","Low-cost Android smartphones are shipping with malicious firmware baked in at the manufacturing or distribution stage, meaning consumers are compromised before they even power on the device. The malware, dubbed Midnight Mimosa, exploits the trusted position of firmware to silently install apps, conduct ad fraud, and enlist devices into residential proxy networks — all without user knowledge or consent. This is a classic supply chain attack where the integrity of the hardware supply chain has been undermined, making traditional endpoint security controls ineffective after the fact. The threat is particularly dangerous because affected users — often those least able to afford premium devices — have no realistic way to detect or remediate the compromise themselves. It underscores that security must be validated at every point in the supply chain, not just at the endpoint.","**Immediate actions:**\n- Avoid purchasing ultra-low-cost Android devices from unverified vendors or grey-market resellers until firmware integrity can be confirmed.\n- Use a reputable mobile threat defense (MTD) tool to scan newly acquired devices for anomalous firmware-level processes before connecting them to corporate or sensitive networks.\n- Perform a factory image comparison or firmware integrity check against official OEM firmware hashes before deploying any budget Android device.\n\n**Long-term improvements:**\n- Establish a formal hardware procurement policy that requires vendors to provide signed firmware attestation and a Software Bill of Materials (SBOM) for all devices.\n- Enforce Mobile Device Management (MDM) enrollment with compliance checks so that devices exhibiting suspicious background activity are automatically quarantined.\n- Engage only with device manufacturers that participate in the Android Enterprise Recommended program or equivalent supply chain security certification schemes.\n\n**Detection measures:**\n- Monitor network traffic from mobile devices for unexpected outbound proxy or tunneling connections that may indicate residential proxy activity.\n- Implement anomaly detection on DNS and egress traffic to flag devices contacting known ad fraud or command-and-control infrastructure.\n- Conduct periodic threat-hunting exercises focused on firmware-level persistence mechanisms across your mobile device fleet.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 3: Data Protection","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-124: Guidelines for Managing Mobile Device Security","NIST CSF DE.CM-7: Monitoring for Unauthorized Activity","NIST SR-3: Supply Chain Controls and Processes","GDPR Article 32: Security of Processing (for organizations handling EU personal data via affected devices)","ISO\u002FIEC 27036: Information Security for Supplier Relationships","ITIL: Service Configuration Management (hardware baseline integrity)",{},"published","2026-10-13T08:20:19.152247+00:00","2026-10-13T08:20:19.126+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Flow-cost-android-phones-ship-with.html","low-cost-android-phones-ship-with-preinstalled-malware-that-turns-them-into-resi-563584","Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":50,"name":51,"problem":52},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":54,"name":55,"problem":56},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]