🔍 Bitdefender tracks firmware-level Android malware on low-cost phones

Bitdefender says the Midnight Mimosa cluster was found preinstalled in firmware on budget Android phones using MediaTek platforms, affecting thousands of devices across 150+ countries. Hidden in system packages, it cannot be removed by users, silently installs apps, commits ad fraud, and can turn phones into proxy relay nodes. Bitdefender’s Midnight Mimosa report also links the infrastructure to older Android fraud families.

The main issue is placement, not just payload: with system privileges and persistence in the system partition, it bypasses app store checks, install prompts, Play Protect visibility, and uninstall.

🛰️ Open sources - closed narratives
@sitreports