🕵️ RESEARCH & DEEP DIVES
Low-cost Android phones ship with firmware malware turning devices into residential proxies
Low-cost Android smartphones have been shipped with preinstalled firmware malware that covertly installs apps, commits ad fraud, and turns devices into residential proxy nodes.- Affects low-cost Android smartphones built on MediaTek platforms across several brands, with most infected devices in Mexico, followed by France, Italy, the U.S., Germany, Brazil, and other countries.
- Bitdefender tracks the campaign as Midnight Mimosa: preinstalled malware ("com.android.system.lite") runs with system-level privileges and cannot be removed by normal uninstall.
- The malware fetches remote configuration, downloads payloads for ad fraud and silent app install/removal, and enrolls devices as residential-proxy relay nodes in botnets.
- It disables the Google Play Store before installing payload apps to bypass Play Protect, then re-enables it; dropper apps masquerade as utility apps, with 13 related apps found on Google Play.
- Firmware signed with certificates attributed to Shenzhen Zediel Co., Ltd suggests a device supply chain compromise, with infrastructure overlaps to Android.Phantom click fraud malware documented by Doctor Web.
ESET names Gorbag, a new Russia-aligned espionage group targeting Ukrainian entities
ESET has identified Gorbag, a newly discovered Russia-aligned cyberespionage group conducting targeted one-time intelligence theft against Ukrainian organizations since early 2025.- Targets Ukrainian military, law enforcement, defence industry (especially drone manufacturers), and local governments since early 2025.
- Operations focus on one-time data theft rather than long-term network persistence.
- Initial access via spearphishing from compromised legitimate accounts, with lures themed on conscription, administrative processes, and drone procurement.
- Attachments deploy a custom PowerShell backdoor or a rapidly evolving infostealer extracting browser credentials and files.
- Malware exfiltrates data then self-deletes to hinder forensics; activity aligns with Russian priorities including war-crime investigation monitoring.
🔓 CVEs & KEV
- CVE-2026-109758 — Perforce Helix Authentication Service — CVSS 9.3 — Perforce Helix Authentication Service (HAS) deployments that retain the shipp...