Low-cost Android phones ship with residential proxy malware

A malware campaign named ‘Midnight Mimosa’ affects budget Android smartphones, with malicious software pre-installed directly into the device firmware. This compromise enables threat actors to silently push applications, execute ad fraud, and convert user devices into residential proxies for traffic routing. It presents significant security risks for both individual users and enterprise environments interacting with compromised devices.