[Single source] Malware comes preinstalled on low-cost Android devices

A Reddit submission says researchers identified an Android malware campaign called Midnight Mimosa in the firmware of low-cost devices and in 13 Google Play apps. The post alleges that infected phones can quietly install apps, collect device information and serve as residential proxy nodes, but it provides no affected models or remediation details.[1]Bitdefender reveals Midnight Mimosa malware preinstalled on low-cost Android devicesreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

According to the submission, the compromise begins in device firmware, before the owner first uses the phone. It also says researchers connected 13 apps distributed through Google Play to the same malicious code and infrastructure, suggesting a second route onto devices.[1]Bitdefender reveals Midnight Mimosa malware preinstalled on low-cost Android devicesreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

If the report is accurate, firmware-level access would give the malware unusually powerful permissions and make ordinary app removal insufficient. Turning phones into residential proxies could also let operators route internet traffic through victims' connections without their knowledge.[1]Bitdefender reveals Midnight Mimosa malware preinstalled on low-cost Android devicesreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

The supplied report does not name affected device models, list the 13 apps or offer verified removal instructions. Without those details, it does not support a model-specific fix or a reliable way for users to determine whether their phone is affected.[1]Bitdefender reveals Midnight Mimosa malware preinstalled on low-cost Android devicesreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

The submission attributes the findings to Bitdefender security analysts and describes the claimed capabilities and two distribution paths. It does not provide the underlying research, technical indicators, infection counts, affected brands, geographic scope, campaign timeline or evidence that Google or device manufacturers have responded.[1]Bitdefender reveals Midnight Mimosa malware preinstalled on low-cost Android devicesreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

The Reddit author says researchers found Midnight Mimosa preinstalled on low-cost Android phones and linked it to 13 Google Play apps. No statement from Bitdefender, Google, a handset maker or an affected user appears in the supplied evidence, so the attribution cannot be independently checked from this lot.[1]Bitdefender reveals Midnight Mimosa malware preinstalled on low-cost Android devicesreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

The reported picture extends beyond a firmware supply-chain problem: the submission claims the same code and infrastructure also appeared in apps from the official store. That alleged link broadens the scenario from devices compromised before purchase to software users may have installed later.[1]Bitdefender reveals Midnight Mimosa malware preinstalled on low-cost Android devicesreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

1 independent groups, 1 updates, and 0 engagements. Observed communities: r/pwnhub.

The submission alleges that Midnight Mimosa runs with system-level privileges, can install or remove applications, gather device information and support advertising or click fraud. It further claims that compromised phones become residential proxy nodes, meaning third-party traffic is routed through their consumer internet connections.[1]Bitdefender reveals Midnight Mimosa malware preinstalled on low-cost Android devicesreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list

The substantive evidence is a single Reddit submission summarizing alleged research without linking the primary report or presenting technical artifacts. A second item is only an automated community welcome message and adds no corroboration, so the campaign's details should be treated as unverified claims rather than independently confirmed findings.[1]Bitdefender reveals Midnight Mimosa malware preinstalled on low-cost Android devicesreddit.com · _cybersecurity_ · r/pwnhub · redditOpen original sourceSee in source list[2]AutoModeratorreddit.com · AutoModerator · r/pwnhub · redditOpen original sourceSee in source list