# Bitdefender finds firmware malware turning Android phones into proxy relays

_Published Tuesday, October 13, 2026 at 4:07 AM EDT · Security · Latest · Tier 2 — Notable_

![Bitdefender finds firmware malware turning Android phones into proxy relays — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWazS9FTiMttWg9JuwySbOkXe9WBGk6EnDbYXfmFzGaoTsXD3FQKLo7YxjnYk9MIZlfmdt08nW3qRKbLggGv2H7ondflK4CbpXu98CiCxnccJfwnrvUwEhMVIHUdt7GO198VkHXASs12AKWj4r44vpT5mF5BHLqX9spJT24dZmpMGqOKyuqoh25f1UuqpY/s1700-nu-rw-lo-l85-e365/android-malware.jpg)

Bitdefender identified preinstalled malware on low-cost Android phones that lets operators install and remove apps, grant permissions and execute remotely supplied code. The campaign, called Midnight Mimosa, targets devices built on MediaTek platforms across several brands and uses additional apps for ad fraud and residential proxies that relay traffic through users' devices.

The malware temporarily disables Google Play Store before installing payload apps, apparently to bypass Play Protect. Bitdefender also found 13 Google Play apps communicating with the same control servers.

Owners cannot remove the firmware component through ordinary uninstall tools. Some affected firmware bears certificates attributed to Shenzhen Zediel, but the manufacturer's involvement or awareness is unclear.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/low-cost-android-phones-ship-with.html)

---
Canonical: https://techandbusiness.org/newswire/3-OdMl7xJWU9QyBbh4JFNp
Published: 2026-10-13T08:07:18.154Z
Story chronology: 2026-10-13T06:00:11.000Z
Retrieved: 2026-10-13T10:11:38.912Z
Publisher: Tech & Business (techandbusiness.org)