Midnight Mimosa malware ships in Android phone firmware
A platform-signed system app installs ad-fraud plugins after briefly disabling the Play Store; proxy use was not seen.
70
Product
Google Play
- Mentions · 7d0
- Mentions · 30d9
- All mentions21
- First seenSep 10, 2026
- Last mentioned10d ago
Timeline
21 articles · newest firstGoogle Play Hosted Fake Chrome App With 100,000+ Downloads
Google Play hosted a Hizbartech fake Chrome app, later removed, that showed 100,000-plus downloads.
60
Fake Chrome App on Google Play Evades Detection and Reaches 100,000+ Downloads
A Hizbartech app impersonated Chrome on Google Play and showed a disputed 100,000-download badge before apparent removal.
48
Google wants to host your personal vibe-coded apps in the Play Store
Google is expanding Play Store AI discovery and will privately host user-built apps.
46
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Preinstalled Midnight Mimosa malware on cheap Android phones enables ad fraud and residential proxies.
76
Low-cost Android phones are arriving with malware that owners can’t uninstall
Bitdefender found preinstalled Midnight Mimosa malware on budget Android phones that owners cannot uninstall.
74
Midnight Mimosa Infects Android Phones Before Users Even Turn Them On
Midnight Mimosa ships in low-cost Android firmware, silently running ad fraud and proxy modules before first boot.
76
Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries
Bitdefender found Midnight Mimosa firmware malware preinstalled on budget Android phones in over 150 countries.
72
The phone was compromised before the user turned it on: the rise of Midnight Mimosa
Bitdefender found preinstalled Midnight Mimosa malware on low-cost Android phones, enabling fraud, proxies, and remote control.
76
Statistical Foundations for a Google Play User-Review Sentiment Index: Signal Fusion, Shrinkage, Distributional Validation, and Dynamic Smoothing
Researchers define a Google Play review sentiment index using signal fusion, shrinkage, and Kalman smoothing.
12
RemControl Banking Trojan Gives Attackers Remote Control of Android Devices
RemControl, an Android banking trojan, remotely controls devices and steals credentials from customers of 30-plus banks.
74
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
ThreatsDay details the RemControl Android banking trojan, a ZCode source leak, and related phishing and ICS risks.
61
New Android malware RemControl steals banking PINs and blocks removal attempts
Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.
73
RemControl Android Malware Targets 30+ Banking Apps to Steal PINs and Credentials
RemControl Android trojan overlays 30-plus banking apps, stealing PINs and streaming screens through accessibility abuse.
76
Identifying Suspected Mislabeled Apps in Google Play Application Removal Prediction: An Empirical Comparison of Label Noise Detection Methods
Researchers compare three label-noise detectors on 870,514 Google Play apps used to predict removals.
46
Researchers Find Security Risks in 73.6% of 61,500 Abandoned IoT Apps
A study of 61,500 abandoned Android IoT companion apps found 73.6% contain vulnerable libraries, dead domains, or insecure data flows exposing sensitive user data.
40
New RatHat Android malware uses AI to automate device control
Zimperium discovered RatHat, an AI-assisted Android banking trojan linked to Chinese actors, stealing credentials via overlays and intercepting SMS one-time passwords.
65
Google’s Early Access is creating a blind spot for malicious apps
Bitdefender found thousands of Google Play Early Access apps with deceptive behavior, including ad-fraud-capable utilities requesting excessive permissions on Android devices.
45
New Android malware encrypts files, steals data, and harasses victims
Zimperium details Mantax Otax, an Android malware combining ransomware, spyware, and harassment, spread via phishing APKs to Indonesian users.
48
Google Play Early Access Abused to Push Thousands of Deceptive Android Apps
Bitdefender found abuse of Google Play's review-free Early Access program to push thousands of deceptive casino and reward apps promoted with AI deepfake ads.
50
Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews
Bitdefender reports deceptive Google Play Early Access apps use deepfake celebrity ads and fake rewards to lure users into ad-fraud schemes.
42
Appears with
- Googlevendor · 20
- Androidproduct · 14
- Bitdefenderorganization · 8
- Googleorganization · 6
- Midnight Mimosamalware · 6
- MediaTekvendor · 5
- Bitdefendervendor · 5
- Group-IBorganization · 5
- RemControlmalware · 4
- UNKKthreat actor · 3
- TVTapproduct · 3
- Zimperiumvendor · 2
- Shenzhen Zedielorganization · 2
- Telegramproduct · 2
- Google Chromeproduct · 2
- Mantax Otaxmalware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.