Midnight Mimosa hides ad-fraud malware in cheap Android firmware
Bitdefender saw thousands of infected phones in more than 150 countries over about two years.
74
Vendor
MediaTek
- Mentions · 7d0
- Mentions · 30d10
- All mentions11
- First seenSep 9, 2026
- Last mentioned10d ago
Timeline
11 articles · newest firstLow-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Preinstalled Midnight Mimosa malware on cheap Android phones enables ad fraud and residential proxies.
76
Low-cost Android phones are arriving with malware that owners can’t uninstall
Bitdefender found preinstalled Midnight Mimosa malware on budget Android phones that owners cannot uninstall.
74
Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue
Midnight Mimosa, preinstalled Android firmware malware, monetizes thousands of phones in 150 countries through ad fraud and proxies.
74
Midnight Mimosa Infects Android Phones Before Users Even Turn Them On
Midnight Mimosa ships in low-cost Android firmware, silently running ad fraud and proxy modules before first boot.
76
Bitdefender finds preinstalled Android malware you can’t uninstall, seen in 150 countries
Bitdefender found unremovable Midnight Mimosa malware preinstalled on cheap MediaTek Android phones in 150 countries.
78
Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries
Bitdefender found Midnight Mimosa firmware malware preinstalled on budget Android phones in over 150 countries.
72
Low-cost Android phones ship with residential proxy malware
Midnight Mimosa malware preinstalled on cheap Android phones enables ad fraud and residential proxy abuse.
74
The phone was compromised before the user turned it on: the rise of Midnight Mimosa
Bitdefender found preinstalled Midnight Mimosa malware on low-cost Android phones, enabling fraud, proxies, and remote control.
76
MediaTek Fixes 31 Security Flaws Affecting Modem, Video and AI Components
MediaTek's October bulletin patches 31 chipset flaws, including two critical modem out-of-bounds writes, with no known exploitation.
64
Android Security Update September 2026 – Fix for Critical Flaws that Enable RCE Attacks
Google's September 2026 Android bulletin fixes over 30 critical flaws, including no-interaction system RCEs, a TIPC kernel RCE and a Qualcomm closed-source bug
55
Related CVEs
by mentions- Out-of-bounds write privilege escalation in MediaTek NeuroPilot
- Use-After-Free Privilege Escalation in MediaTek APU
- CVE-2026-28662<1%8.0Heap Buffer Overflow in Android Wi-Fi Direct (P2P) Provisioning Discovery Enables Nearby RCE
- CVE-2026-28590<1%7.8Improper Encryption Key Validation Enables Local Privilege Escalation in Android
- CVE-2026-58820<1%7.8Android OS Integer Overflow Enables Local Privilege Escalation
- CVE-2026-45531<1%7.8Local Privilege Escalation via Heap Overflow in Android fsck
- Out-of-bounds write in MediaTek modem enables remote EoP
- Out-of-bounds write in MediaTek venc video encoder
- CVE-2026-55256<1%6.5Remote Persistent Denial-of-Service in Android parsePartHeaders (CVE-2026-55256)
- Double-free local DoS in MediaTek APU
Appears with
- Androidproduct · 10
- Googlevendor · 9
- Midnight Mimosamalware · 9
- Bitdefenderorganization · 9
- Google Playproduct · 5
- Bitdefendervendor · 3
- Shenzhen Zedielorganization · 3
- Cubotvendor · 2
- Doogeevendor · 2
- Android.Phantommalware · 2
- Googleorganization · 1
- Android.Jokermalware · 1
- Keenadumalware · 1
- Qualcommvendor · 1
- Unisocvendor · 1
- Doctor Weborganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.