Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

What happened

Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies  Ravie Lakshmanan  Oct 13, 2026 Mobile Security / Cybercrime Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. Google is a software and Internet company based in Mountain View, and its products and services include Software tools.

The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa. The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa .

The preinstalled malware ("com.android.system.lite") runs with system-level privileges, which make it possible to install or uninstall apps, grant itself additional permissions to accessibility services, notifications, and SMS, and load arbitrary code supplied remotely by the operators. Specifically, it fetches a remote configuration from an external server and then downloads and executes additional payloads designed to conduct ad fraud and silent installation or removal of partner apps.