Midnight Mimosa: Malware Found in Firmware of Cheap Android Smartphones

⚡ The gist in 5 seconds - Researchers have discovered the Midnight Mimosa campaign targeting cheap Android smartphones through the firmware. - The malware is already built into the device at purchase — the victim doesn't need to install anything. - Attackers can covertly install apps, carry out ad fraud, and turn smartphones into residential proxies. ### 🔍 What was found Security specialists uncovered a malicious campaign dubbed Midnight Mimosa targeting budget Android smartphones. The malware is baked right into the firmware: the user receives an infected device "out of the box," even before the first boot. Details about specific models and manufacturers have not yet been disclosed, but the attack has already received an official name. The mechanics are simple and dangerous: the embedded software allows attackers to silently install apps, generate fake clicks for ad fraud, and use the smartphone as a residential proxy for traffic. As a result, the device becomes part of a botnet without the owner's knowledge, and the malware cannot be removed by standard means — it lives at the system partition level. ### 💡 Why it matters Pre-installed malware in firmware is a serious problem for the budget Android segment, where manufacturers often cut corners on security and use third-party firmware. Unlike infection via app downloads, this vector is practically invisible to antivirus software and requires reflashing the device to clean it. Buyers of inexpensive smartphones should pay close attention to the supply channel, and researchers should continue monitoring the campaign, as the scale of Midnight Mimosa may turn out to be significantly wider than the initial findings.