Cheap Android Phones: Midnight Mimosa Firmware Bug Enables Silent App Installs and Proxy Abuse

Low-cost Android smartphones are arriving with malware already embedded in their firmware before buyers switch them on. Security researchers have identified a campaign dubbed Midnight Mimosa that compromises devices at the manufacturing or distribution stage. This preinstallation means the threat exists before the user interacts with the phone, bypassing standard initial setup security checks. The discovery highlights a significant supply chain vulnerability affecting inexpensive mobile hardware.

In plain English

The malware operates at the deepest level of the phone's software, known as firmware. Because it is baked into the system before the device reaches the consumer, standard antivirus scans may not detect it immediately. Attackers use this access to silently install additional applications on the phone. These apps run in the background without the user knowing or consenting. The primary goal is to generate fraudulent advertising revenue and abuse proxy networks.

The background

According to BleepingComputer, the Midnight Mimosa campaign specifically targets low-cost Android smartphones. The malware enables attackers to turn these compromised devices into residential proxies. This means the phone’s internet connection is used to mask the attacker's true location and identity. Hackread reported that these phones arrive already compromised, with the malicious software present before the first boot. This method allows for large-scale ad fraud operations using legitimate-looking residential IP addresses.

What changes now

Organizations purchasing devices for employees or field operations must reassess their procurement strategies for low-cost hardware. The presence of firmware-level malware indicates that hardware integrity cannot be assumed for budget devices. Security teams need to verify the supply chain for all mobile endpoints. This incident demonstrates that the attack surface extends beyond the operating system into the underlying firmware. Companies should treat unverified low-cost devices as high-risk assets until proven otherwise.

Background: Supply chain attacks

Supply chain attacks compromise trusted software or hardware before it reaches you. Attackers inject malicious code into updates or dependencies, allowing them to enter your network through legitimate channels. You must verify digital signatures and limit privileges to stop this silent infiltration.

Read the full guide: Supply Chain Attacks: How Compromised Dependencies Breach Your Network

What to do and how to stay safe: Midnight Mimosa

• Audit the supply chain for all low-cost mobile devices to ensure they come from verified manufacturers and authorized distributors.
• Implement strict network monitoring to detect unusual outbound traffic patterns that may indicate proxy abuse or command-and-control communication.
• Enforce mobile device management policies that restrict the installation of unsigned or unauthorized applications on corporate-owned devices.
• Perform deep security scans on new devices before connecting them to the corporate network, checking for firmware anomalies.

Step-by-step guide: DDoS Protection: 8 FAQs on Mitigation and Architecture

General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is Midnight Mimosa malware?

Midnight Mimosa is a malware campaign found on low-cost Android phones, embedded in the firmware to enable ad fraud and proxy abuse.

How does the malware infect the phones?

The malware is preinstalled in the device firmware before the buyer switches the phone on, according to reports by Hackread and BleepingComputer.

What can the malware do on an infected device?

It allows attackers to silently install apps and turn the device into a residential proxy for fraudulent activities.