Security
Midnight Mimosa malware found preinstalled on cheap Android phones
Bitdefender says thousands of low-cost Android devices shipped with firmware malware; Cisco and Microsoft also patch actively exploited zero-days.
This edition was produced with artificial intelligence. Text and voice are generated automatically.
Midnight Mimosa malware shipped in firmware of low-cost Android phones
Bitdefender uncovered Midnight Mimosa, a campaign embedding malware in the firmware of low-cost Android phones with MediaTek chipsets, giving it system-level privileges to silently install apps, commit ad fraud, and turn devices into residential proxies. Researchers say thousands of devices across more than 150 countries were affected over roughly two years, with the most victims in Mexico, France, Italy, the United States, Germany, Brazil, and Spain. Devices from Doogee and Cubot were among those affected, alongside phones impersonating Samsung and Apple. The malware disables Google Play Store before installing apps to evade Play Protect, then re-enables it. Bitdefender also found 13 Google Play apps carrying the same ad-fraud code. Removal requires firmware-level cleanup or Android Debug Bridge.
Low-cost Android phones ship with residential proxy malware →
Topics: Malware & infostealers
Cisco patches exploited Secure Email Gateway zero-day
Cisco released fixes for an actively exploited zero-day in its Secure Email Gateway that lets unauthenticated remote attackers execute commands with root privileges. Tracked as CVE-2026-76519, the flaw is a relative path traversal in the Advanced Malware Protection feature caused by improper handling of email attachments; attackers exploit it by sending a crafted attachment through an unpatched device. Cisco’s PSIRT learned of active exploitation in October 2026. Affected instances have File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525. Cisco deployed mitigations on cloud instances and contacted owners where compromise was suspected, urging credential renewal and restricted appliance access. Shadowserver tracks nearly 300 exposed Secure Email Gateway instances online.
Cisco patches new Secure Email Gateway zero-day exploited in attacks →
Topics: Zero-day vulnerabilities
Microsoft fixes 1,413 flaws, including an exploited Windows zero-day
Microsoft’s October Patch Tuesday addressed 1,413 vulnerabilities, per CrowdStrike, including 75 Critical flaws and three zero-days, one actively exploited. The standout is CVE-2026-96951, an exploited Windows Shell security-feature-bypass flaw with a CVSS score of 8.8 that lets attackers bypass Mark of the Web, potentially suppressing SmartScreen warnings and Office Protected View. Two other zero-days were publicly disclosed before fixes: CVE-2026-108398 in .NET Framework and CVE-2026-92707 in MessagePack-CSharp. CrowdStrike flagged five Critical Outlook remote code execution flaws scoring 9.8, two exploitable through the Reading Pane without user interaction. Windows 11 24H2 Home and Pro reached end of servicing on Oct. 13, 2026.
Microsoft Patch Tuesday Fixes 1,413 Flaws: Windows Zero-Day Already Under Attack →
Topics: Windows securityPatch Tuesday & security updatesZero-day vulnerabilities
Google adds Android scam defenses that hang up on fake bank calls
Google is rolling out Android protections against scams across Messages, screen sharing, notifications, and call forwarding. Screen sharing can now automatically black out login fields and payment screens on Android 15 or newer, starting this month. An optional Enhanced protection mode in Messages will use cloud Gemini models to analyze complex conversations with unknown senders, while Gemini Nano judges unfamiliar links locally. Apps will no longer be able to silently enable call forwarding, with protections arriving in early December on Pixel and select devices. Android can hang up automatically when it cannot verify an incoming bank call, partnering with Banco do Brasil, ItaĂş Unibanco, and Revolut. Google cites a 195.7% rise in bank impersonation scams.
Google’s new scam defenses on Android can hide your bank details and hang up on fraudsters →
Czech agency confirms Russian Signal phishing, fifth NATO nation
The Czech Republic’s NÚKIB confirmed Russian-linked actors are running targeted phishing campaigns against Signal users, with incidents inside the country, becoming the fifth Western agency to attribute the operation. Dutch, German, American, and Ukrainian counterparts corroborated it over eight months; all agree Signal’s end-to-end encryption was not broken. The attack abuses Signal’s multi-device linking: a malicious QR code pairs the account to attacker-controlled infrastructure. Germany saw roughly 300 political accounts compromised, per Der Spiegel, including two unnamed government ministers. The FBI reported in March 2026 that unauthorized access reached thousands of accounts worldwide. Google’s Threat Intelligence Group tied tracks to APT44, UNC5792, UNC4221, and Turla. NÚKIB urges auditing Linked Devices and enabling Registration Lock.
Russia Compromised Signal Accounts in Five NATO Nations; Czech Republic Confirms Breach →
Topics: PhishingState-sponsored hackingMessaging apps privacy