A little something extra comes preinstalled. [Research Saturday]

Today Cristian Silviu Stahie, Security Analyst from Bitdefender, joins to discuss their work on The phone was compromised before the user turned it on: the rise of Midnight Mimosa. Bitdefender researchers have uncovered a malware campaign dubbed Midnight Mimosa that comes preinstalled on low-cost Android devices, compromising phones before users even turn them on.

The malware operates with system-level privileges, allowing attackers to silently install and remove apps, commit ad and click fraud, collect device information, and turn infected phones into residential proxy nodes for botnets. Researchers also identified 13 apps on Google Play sharing the same malicious code and infrastructure, highlighting how the campaign reaches users through both compromised device firmware and seemingly legitimate apps.

The research and executive brief can be found here:

• ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠The phone was compromised before the user turned it on: the rise of Midnight Mimosa

Learn more about your ad choices. Visit megaphone.fm/adchoices