Midnight Mimosa malware ships in Android phone firmware
A platform-signed system app installs ad-fraud plugins after briefly disabling the Play Store; proxy use was not seen.
70
Organization
PolySwarm
- Mentions · 7d0
- Mentions · 30d2
- All mentions3
- First seenSep 9, 2026
- Last mentioned10d ago
Timeline
3 articles · newest firstHackers Exploit Exposed Industrial Controllers to Disrupt US Water and Critical Infrastructure
Attackers disrupted US water utilities via exposed Rockwell controllers, alongside other industrial-control campaigns.
86
Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs
Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.
55
Appears with
- Googlevendor · 1
- UNC1549threat actor · 1
- Google Playproduct · 1
- aviationvictim · 1
- Viteproduct · 1
- fintechvictim · 1
- Androidproduct · 1
- NodeRabbitproduct · 1
- Unitronicsvendor · 1
- Volt Typhoonthreat actor · 1
- CyberAv3ngersthreat actor · 1
- NodeRabbitmalware · 1
- PolySwarmvendor · 1
- PollCatproduct · 1
- Reactproduct · 1
- Rockwell Automationvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.