Cheap Android phones ship with factory malware, and Mexico tops the list
Bitdefender found malware in the firmware of low-cost Android phones; Mexico is where it was detected most. Also: Windows Update certificates, batteries vs. gas and Cloudflare with Deno.
By Frank González
TL;DR Quick summary
- Bitdefender found Midnight Mimosa in the firmware of cheap Android phones with MediaTek chips; Mexico, France and Italy lead the detections.
- It installs and deletes apps without permission, runs ad fraud and can turn the phone into a proxy. Uninstalling does not remove it.
- Windows Update certificates expire on May 17 and June 19, 2027: PCs without recent updates will stop getting patches.
- Wood Mackenzie: four-hour batteries are now cheaper than peaking gas turbines in all 43 markets it compared.
- Cloudflare takes on the Deno team: the runtime gets one more year of patches and Deno Deploy shuts down in six months.
The briefing on video
Video transcript
Good morning. Some cheap phones come out of the box with malware already inside, and Mexico is the country where it was found the most.
The security company Bitdefender found it and named it Midnight Mimosa. It lives in the firmware of low-cost Android phones with MediaTek chips, many from little-known brands or knockoffs of Samsung and iPhone. It showed up in more than one hundred fifty countries. Mexico, France and Italy lead the list.
Firmware is what's burned into the phone before anything else. It's like buying a house and the seller kept a copy of the key. You change the furniture, but he still walks in.
With that access it installs apps without asking, at least thirty-two disguised as weather or app-lock tools, runs ad fraud and can use your connection for other people's traffic. And uninstalling won't remove it.
Cheap turns out expensive, sure. But what bothers me is something else. The phone already had an owner before you turned it on.
Microsoft announced that Windows Update certificates expire in May and June of twenty twenty-seven. Computers without recent updates, or on an unsupported version, will stop getting patches. If you have Windows eleven twenty-five H two or newer, you don't need to do anything.
The consultancy Wood Mackenzie calculated that four-hour batteries are now cheaper than peak-hour gas turbines in all forty-three markets where it compared the two.
And Cloudflare took on the Deno team, led by Ryan Dahl, the creator of Node. The engine gets one more year of patches, and Deno Deploy shuts down in six months.
The sources are at ankincloud dot com slash noticias. Open them yourself, I'm tired of reading reports.
Anyway. I'm going to check who else has a key to my house. I'm disappearing until further notice.
Today the news isn't about an app you downloaded by mistake. It's in the phone itself, before you ever turned it on. A security company found malware burned into cheap Android phones at the factory, and the country where it detected the most cases is Mexico.
This is all in a very long technical report you are not going to read, so I'll read it for you. On top of that: Microsoft puts an expiration date on computers that never update, batteries beat gas on price and Cloudflare takes on the people behind Deno.
Cheap Android phones ship with factory malware, and Mexico is where it was detected most
On October 8 Bitdefender published its research on Midnight Mimosa, malware that ships from the factory on cheap Android phones. It sits in the firmware of several brands' phones with MediaTek chips. It poses as a system app (com.android.system.lite and variants) and, with system privileges, silently installs and removes apps, grants permissions and runs code it downloads from its servers. It was detected on thousands of devices in more than 150 countries over about two years; Mexico, France and Italy come first, followed by the United States, Germany, Brazil and Spain.
The models with the most cases are Doogee's S200 X and Cubot's KINGKONG X, plus knockoffs with names like "S25 Ultra" or "i17 Pro Max". The malware distributes at least 32 apps disguised as weather, app-lock or file-manager tools that commit ad fraud; it disables the Play Store while installing, and one of its apps can turn the phone into a residential proxy. Bitdefender also found 13 apps on Google Play with the same fraud code. Nobody knows at what point in the supply chain it was added, and uninstalling does not work.
Key facts
- 150+countries with detections
- 32disguised apps
- 13apps on Google Play
- 2 yearsof activity, roughly
Explained for humans
What is firmware, and why doesn't uninstalling help here?
Firmware is the software burned into the phone at the factory, underneath your apps. It's like buying a house where the seller kept a copy of the key: you change the furniture, but he still walks in. Because the malware lives in that layer, the uninstall button can't touch it, and these phones sell on popular online stores.
- Factory firmware
- ships inside
- Fake system app
- asks for orders
- Control server
- sends apps
- Apps and ads
- can use it
- Your connection
Why should you care?
If you bought a very cheap Android online, especially an unknown brand or a Samsung or iPhone knockoff, it could have this. For a small business the risk is double: on the office Wi-Fi it can lend your connection to strangers, and whoever controls it can install anything.
What to do
- Check whether your Android is certified: Play Store → profile icon → Settings → About → Play Protect certification. Google warns that an uncertified device may not be secure or receive updates.
- Before buying, be wary of names that imitate others, like "S25 Ultra" or "i17 Pro Max" on a phone that isn't made by Samsung or Apple: several affected devices came that way.
- If you have a Doogee S200 X or a Cubot KINGKONG X, look for the manufacturer's official update and ask their support whether it fixes the problem; uninstalling apps won't remove it.
- Don't connect a suspicious phone to the same Wi-Fi as the checkout or accounting computer; use the guest network.
Frank's take
We spent years telling people not to download weird apps, and it turns out the weird app was already in the box, next to the charger. Cheap turns out expensive, sure, but that's the least of it. What keeps me up is that the phone already had an owner before you turned it on. You think you're buying a device. Sometimes you're just renting a spot in someone else's house.
Glossary
4 terms
- Firmware
- Software burned into a device at the factory, below the operating system and apps; it controls the hardware directly.
- Residential proxy
- An ordinary home device that relays other people's traffic so it looks like it comes from there; it's sold as a service, sometimes without the owner knowing.
- Ad fraud
- Showing hidden ads or faking clicks to charge advertisers for views nobody made.
- Play Protect
- Google's system that checks Android apps; a certified device passed Google's compatibility and security tests.
Sources
- The phone was compromised before the user turned it on: the rise of Midnight Mimosa (opens in a new tab) bitdefender.com
- Low-cost Android phones ship with residential proxy malware (opens in a new tab) bleepingcomputer.com
- Thousands of cheap Android phones shipped with ad-fraud malware (opens in a new tab) therecord.media
Windows Update changes certificates in 2027, and PCs without updates will stop getting patches
On October 8 Microsoft announced that the certificates computers use to connect securely to Windows Update expire on May 17 and June 19, 2027. Devices without the replacement certificates will lose access to Windows Update and won't receive any updates. The change does not apply to devices that get updates through WSUS.
Windows 11 25H2 and later need no action. Windows 11 24H2 and Windows Server 2025 need the September 2025 security update or later before June 19, 2027; other supported Windows 11 versions, Windows Server 2022 and supported Windows 10 need the July 2026 update or later by the same date. Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and 2016 have until May 17, 2027. Any other version has to move to a supported one.
Key facts
- May 17LTSC and Server deadline
- June 19Windows 11 and 10 deadline
- 25H2or newer: nothing to do
Explained for humans
What is a certificate, and why does it expire?
A digital certificate is the ID your computer uses to check that an update really comes from Microsoft and not an impostor. Like a driver's license, it expires. Computers that update regularly already have the new one without noticing; those months behind, or on an unsupported version, will be left at the door.
- Windows Updateverified withNew certificate
- New certificatekeeps receivingYour updated PC
- Windows Updateno access in 2027Un-updated PC
Why should you care?
Many small businesses have a computer at the register or front desk that nobody updates because "it works fine". Starting in 2027 that machine won't just be behind: it won't be able to receive patches even if someone wants to. And whoever sends invoices or opens the bank's email from it is your business.
What to do
- Check your version: Settings → System → About → Windows specifications. With Windows 11 25H2 or later you don't need to do anything.
- If it says 24H2, install pending updates; also, 24H2 support for Home and Pro ends on October 13, 2026, so it's worth moving to 25H2 or 26H2.
- At work, prioritize machines running Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016: their deadline is May 17, 2027.
- If a computer runs an unsupported version, plan to upgrade or replace it before May 2027.
Frank's take
Microsoft is telling the register computer what nobody dared to: update or you're on your own. I think that's fair. The sad part is that there are machines nobody has touched in years, quietly doing their job, and the only way anyone will remember them is when they stop working.
Glossary
3 terms
- Digital certificate
- A signed file used to prove who is who on the internet; here, that the update comes from Microsoft.
- WSUS
- Windows Server Update Services: the server some companies use to distribute Microsoft updates inside their network.
- LTSC
- Long-Term Servicing Channel: business versions of Windows that receive only patches for many years, with no new features.
Sources
- Prepare for Windows Update certificate rotation in 2027 (opens in a new tab) learn.microsoft.com
- Microsoft: Outdated Windows devices will stop receiving security updates (opens in a new tab) bleepingcomputer.com
- Versiones admitidas por clientes de Windows (opens in a new tab) learn.microsoft.com
Four-hour batteries are now cheaper than peaking gas turbines in 43 markets
On October 8 consultancy Wood Mackenzie published its annual levelized cost of electricity report: four-hour battery storage is now cheaper than open-cycle gas turbines in all 43 markets where it compared the two. Solar with trackers is the cheapest new plant in 43 of the 48 markets it modeled. In the Middle East and Africa, four-hour storage costs 120 dollars per megawatt-hour in 2026 and would fall 33% to 80 dollars by 2035.
For Latin America it expects solar to fall 38% and storage 42% by 2060, and says Brazil, Chile and Mexico have a structural advantage thanks to their sunshine. According to TechCrunch, AI data center developers are buying gas turbines in large quantities, which has pushed up their prices: an open-cycle unit takes two to four years to arrive.
Key facts
- 43 of 43markets: batteries win
- -33%Mideast battery cost by 2035
- 2–4 yearswait for a turbine
Explained for humans
What is a peaker plant, and why can a battery replace it?
A peaker plant is a gas turbine that runs only during the hours of highest demand, like the extra checkout lane a store opens at rush hour. A four-hour battery does the same job: it charges with midday sun and releases the energy at peak time. Levelized cost divides everything a plant costs by the energy it delivers.
Why should you care?
AI data centers are pushing up electricity demand and the price of gas turbines. If batteries already win on cost, that changes what gets built to cover peak hours. And for Mexico the report brings good news: the sun gives us an advantage, something anyone who puts panels on their shop roof already knows.
Frank's take
Ten years ago batteries were the expensive experiment and gas was the safe bet. Today the consultancy says batteries win in 43 out of 43 markets. The funny part is who's buying all the turbines: AI data centers. They're in such a hurry to think fast that they can't wait for the battery to charge.
Glossary
3 terms
- Levelized cost
- Everything it costs to build and run a plant over its lifetime, divided by the energy it delivers; used to compare technologies.
- Open-cycle turbine
- A gas turbine that starts quickly to cover peaks but burns more fuel than a combined-cycle one.
- Megawatt-hour
- A thousand kilowatt-hours; roughly the energy about four hundred homes use in a day, depending on consumption.
Sources
Cloudflare takes on the Deno team, and the runtime gets only one more year of patches
On October 9 Ryan Dahl, the creator of Node.js, announced that the entire Deno team is joining Cloudflare. TechCrunch reported it as an acquisition, with terms not disclosed; Deno had raised 26 million dollars, including a Series A led by Sequoia.
According to Deno's blog, Cloudflare will give the runtime one more year of monthly releases with bug fixes and security patches, after which its development ends, although the code stays open source for anyone who wants to continue it. Deno Deploy, its hosting service, will run for six more months and then shut down, with help for paying customers to migrate to Cloudflare Workers. The JSR package registry keeps operating. Cloudflare says it will merge workerd, its Workers engine, with celld, Deno's.
Key facts
- 1 yearmore patches for Deno
- 6 monthsleft for Deno Deploy
- 26 Mdollars Deno raised
Explained for humans
What is a runtime, and what happens if it ends?
A runtime is the engine that executes code, like a diner's stove: the recipe is your program. Deno is a stove for JavaScript outside the browser. If nobody maintains it, it still lights, but nobody fixes the leaks anymore. That's why, if your system runs on Deno, you have a year to decide where to move it.
Why should you care?
If a developer built your business system with Deno or hosts it on Deno Deploy, this affects you: there's a shutdown date for the hosting and for the patches. And it's a useful reminder for any small business: the software you depend on can also change owners overnight.
What to do
- If your app is on Deno Deploy, plan the migration now: the service runs six more months and then shuts down.
- If your system runs on the Deno runtime, ask whoever maintains it what they'll do before patches end, in a year.
- If you only publish or download packages on JSR, you don't need to do anything for now: it keeps operating.
Frank's take
Ryan Dahl made Node, then made Deno to fix what he didn't like about Node, and now he's taking his team to Cloudflare. There's something honest about admitting your thing no longer needs to exist on its own. Almost nobody does that. Most prefer to die with their own logo.
Glossary
3 terms
- Runtime
- The program that executes an application's code; Deno and Node.js run JavaScript outside the browser.
- Cloudflare Workers
- Cloudflare's service for running code on its network of servers spread around the world.
- JSR
- A JavaScript and TypeScript package registry created by the Deno team.
Sources
- Deno is joining Cloudflare (opens in a new tab) deno.com
- Deno joins Cloudflare (opens in a new tab) blog.cloudflare.com
- Cloudflare acquires Deno to improve its Workers programming model (opens in a new tab) techcrunch.com
Learn more
-
Firmware (Wikipedia, in Spanish) (opens in a new tab)
es.wikipedia.org
What the software burned into devices is and why it sits beneath everything else.
-
Proxy server (Wikipedia, in Spanish) (opens in a new tab)
es.wikipedia.org
How a network middleman works, the piece that turns an infected phone into a bridge for other people's traffic.
-
Check if your device is Play Protect certified (Google Play Help, in Spanish) (opens in a new tab)
support.google.com
The official steps to find out whether your Android passed Google's tests, and what it means if it didn't.
-
Windows client supported versions (Microsoft Learn, in Spanish) (opens in a new tab)
learn.microsoft.com
The official table of which Windows versions are supported and until when.