Researchers find firmware malware on low-cost Android phones across more than 150 countries

Bitdefender researchers discovered malware embedded in low-cost Android phone firmware that can silently install applications, generate advertising fraud and register devices as residential proxies, BleepingComputer reports. The campaign, called Midnight Mimosa, affected thousands of devices across more than 150 countries over approximately two years. The malware runs with system privileges and downloads additional modules. It temporarily disables the Google Play Store before installing malicious applications to evade detection, then re-enables it. Ordinary application removal cannot uninstall the firmware components; cleanup requires changes to firmware or disabling components through Android Debug Bridge. Researchers confirmed that the proxy infrastructure accepted device registrations, but their test device received no relay targets, leaving active traffic forwarding unconfirmed.