Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Bitdefender identified a preinstalled, system-privileged Android backdoor called "Midnight Mimosa" on MediaTek-based low-cost phones that can remotely install or remove apps, grant elevated permissions, download payloads for ad fraud and proxyware, and disable the Play Store to evade protections; 13 Play Store apps were found communicating with the same infrastructure, and the activity suggests a supply-chain firmware compromise affecting devices across multiple countries.