Malware found pre-installed on low-cost Android phones

Researchers have discovered malware embedded in the firmware of inexpensive Android smartphones, allowing attackers to remotely install apps, commit ad fraud, and use devices as residential proxies. The malware, called 'Midnight Mimosa,' is present on devices with MediaTek chips and system-level privileges. It affected thousands of devices in over 150 countries and cannot be removed by users. Firmware updates from some manufacturers fixed the issue, but the source of the supply-chain compromise is unclear.

• Malware embedded in firmware of budget Android devices
• Attackers gain system access and silent installation capability
• Thousands of affected phones across more than 150 countries
• Victims primarily in Mexico, France, Italy, US, and others
• Some manufacturers released updates to remove the malware