Phone was compromised before the user turned it on: the rise of Midnight Mimosa

Bitdefender researchers uncovered Midnight Mimosa, a malware family preinstalled in the firmware of low-cost MediaTek-based Android phones. It runs as a persistent, platform-signed system app that cannot be removed and silently installs disguised payloads for ad fraud, click fraud, and residential-proxy botnet recruitment.