[midnight-mimosa]

October 14, 2026

• Preinstalled firmware malware on low-cost MediaTek-based Android phones is turning devices into residential proxies and running covert app installs and ad fraud; Bitdefender tracks it as Midnight Mimosa (The Hacker News). · Threat Activity

in Three Chained Zero-Days Put Root on a Fully Patched Ivanti VPN

October 12, 2026

• Midnight Mimosa is preinstalled Android malware with system-level control. Bitdefender’s research, summarized by Security Affairs, found the implant in firmware on low-cost MediaTek phones from multiple brands across more than 150 countries. It silently installs applications, grants permissions, performs ad fraud, and turns devices into residential-proxy relays. Bitdefender could not determine how it entered the firmware or whether the signing-certificate owner knew about it. · Threat Activity

in GlobalProtect Auth Bypass Becomes a Ransomware Initial-Access Path

October 9, 2026

• Mobile malware, two angles: low-cost Android handsets are shipping with firmware-embedded Midnight Mimosa, which silently installs apps, commits ad fraud and enrols devices as residential proxies (BleepingComputer); and Novinarya targets 81 financial apps via package enumeration, WebView phishing, regex-driven SMS and notification interception, resolving live C2 from encrypted dead-drop URLs planted in a Basalam shop profile (STAR Labs). · Threat Activity

in Third NetScaler RCE in a Month Lands on the Same SAML Surface