Midnight Mimosa: malware found in the firmware of cheap Android smartphones

⚡ The gist in 5 seconds - Researchers have discovered the Midnight Mimosa campaign, which infects cheap Android smartphones via firmware. - The malware is already built into the device at purchase — the victim doesn't need to install anything. - Attackers can covertly install apps, carry out ad fraud, and turn smartphones into residential proxies. ### 🔍 What was found Security specialists have identified a malicious campaign called Midnight Mimosa targeting budget Android smartphones. The malware is embedded directly in the firmware: the user receives an infected device "out of the box," even before the first boot. Data on specific models and manufacturers has not yet been disclosed, but the attack has already received an official name. The mechanics are simple and dangerous: the embedded software allows attackers to silently install apps, generate fake clicks for ad fraud, and use the smartphone as a residential proxy for traffic. As a result, the device becomes part of a botnet without the owner's knowledge, and the malware cannot be removed by standard means — it lives at the system partition level. ### 💡 Why it matters Pre-installed malware in firmware is a serious problem for the budget Android segment, where manufacturers often cut corners on security and use third-party firmware. Unlike infection via app downloads, this vector is practically invisible to antivirus software and requires reflashing the device to clean it. Buyers of inexpensive smartphones should pay close attention to the supply channel, and researchers should continue monitoring the campaign, as the scale of Midnight Mimosa may turn out to be significantly larger than the initial findings suggest.