# Reputation Radar #15: Rented Out of the Box > Budget Android phones are shipping with malware baked into the firmware that quietly rents out the owner's home connection as a residential proxy. Here is why that traffic is close to invisible to reputation checks, the odd way the botnet makes its own servers look popular, and what to watch on your own network. - Published: 2026-10-14 - Author: Reput.io Team - Tags: Threat Intelligence, Infrastructure Reputation, SOC, Weekly Report - Canonical: https://www.reput.io/blog/reputation-radar-15 --- For the last few issues we've watched attackers borrow trust from big platforms: Microsoft 365, Cloudflare, AWS. This week the reputation they borrow is smaller and harder to argue with. It could belong to anyone's mum in Guadalajara, or a student in Lyon: someone who bought a cheap phone online and has no idea it's working a second job. ## Infected before it's switched on Bitdefender Labs [published a deep dive](https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware) on a campaign it calls **Midnight Mimosa**. Low-cost Android phones built on MediaTek platforms are shipping with a malicious system app already in the firmware. Their summary is blunt: *"The compromise is complete before the phone is first switched on."* The models are what you'd expect from the bottom of an online marketplace: region-coded no-name builds, a couple of genuine budget brands, and counterfeit "flagships" sold as an S25 Ultra or S26 Ultra. Bitdefender counted **thousands of devices across more than 150 countries** over about two years, with **Mexico, France and Italy** at the top. The spread looks like global marketplace sales, not one carrier's channel. The app pretends to be a harmless Android component (`com.android.system.lite` and a few siblings), but it's signed with the platform certificate, so it can install and remove apps and grant itself permissions silently. Ordinary users can't uninstall it. As Bitdefender puts it, the durable fix *"sits with the vendors and the marketplaces."* ## Three ways to earn from your phone Once it's running, the app pulls down plugins that make money in three ways. The first is **ad fraud**. It draws invisible ads over the apps you're actually using and taps them for you. The detail that made us wince: the ad surface is flagged as secure, *"so it doesn't appear in screenshots or screen recordings."* You can't even show someone what's happening. The second is the one we care about: a **residential proxy**. The phone checks in with a control server over raw TCP on **port 6000**. It gets handed a list of `host:port` targets, opens the connections, and relays whatever the operator sends. In Bitdefender's words, *"bytes are piped verbatim."* Whoever is renting that proxy now browses, scrapes, logs in or attacks from the owner's home connection. The third is distribution. The same ad-fraud code turned up in **13 apps on Google Play**, weather apps, a QR scanner, a note taker, all of which passed review and talked to the same servers. So you didn't strictly need the dodgy phone to join in. ## What the reputation column shows We ran both sides of this through our own API: where the traffic comes out, and where it's controlled from. **The exit points come back empty.** We looked up consumer broadband addresses on the ISPs that dominate the top countries in the report: Total Play and Uninet in Mexico, Orange in France, Telecom Italia. Every one returned **no feed hits at all**, a confidence score of 4 out of 100, and nothing but the ISP name and city. That's an honest answer, not a gap we're embarrassed about. A home connection with an infected phone on it looks exactly like the house next door. Even when a feed does catch one, the address usually belongs to a household that did nothing wrong, and it may be handed to someone else tomorrow. Proxy services sell residential exits precisely because they carry no history. **The control servers come back popular.** This was the surprise. The command server `api.weatherlive.world` sits in the **top 200K of Cisco Umbrella's** most-queried domains. The proxy domains, random strings like `0aa0cf0637d66c0d.com`, rank in the Tranco top 400K. Nobody visits those on purpose. They rank because thousands of infected phones look them up all day, every day. **The botnet manufactures its own popularity**, the same trick as the npm download farms in [Radar #12](/blog/reputation-radar-12), just as a side effect this time. Our API reports the ranking but labels them as nothing more than high-traffic domains and keeps them on **investigate**, with the caveat we keep attached to every popularity signal: *"Popularity alone isn't trust."* One more admission, for the second week running. The proxy C2 IP in Bitdefender's report, `85.17.70.38`, came back labelled **"Commercial VPN"**, with a hint to go and identify the employee on the VPN. It's actually a rented LeaseWeb server, and Bitdefender has since noted it's now a sinkhole. Bulk VPN tags on hosting ranges had won out over the reason sitting right underneath: "Dedicated server and cloud hosting". We fixed it this week, so LeaseWeb ranges now read as LeaseWeb, with a hint about rented servers. The VPN tags are still visible underneath, so nothing was hidden. Feeding each week's real attack chain through the product keeps turning these up, and we'd rather find them this way than from a customer. So where does that leave a SOC? The useful flip is to stop asking "is this IP bad?" and ask **"is one of my devices someone else's exit node?"** A cheap phone on your guest Wi-Fi turns your office IP into a residential proxy for strangers, and your address is what ends up on someone else's blocklist. What gives it away is behaviour on your side of the network: outbound raw TCP to port 6000, a device opening connections to destinations it has no reason to know, or a MAC address with Bitdefender's hardware marker, OUI `A0:53:94`. None of that depends on a reputation score. ## Also on the radar - **FBI seizes Flax Typhoon's toolbox.** The Justice Department seized seven domains behind **Microscan**, a vulnerability scanner, and **FishHub**, a spear-phishing kit, both run by China's Integrity Technology Group for Flax Typhoon. Targets included a South Carolina power company and airports in Japan and Poland ([DOJ](https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-vulnerability-scanning-and-spear-phishing-tools-operated)). A joint FBI, CISA and NSA advisory went out the same day ([CISA AA26-281A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a)). This is the company that ran a Mirai-style IoT botnet as attack infrastructure, the same borrowed-device theme as this week's lead. - **Ivanti Connect Secure, root on patched boxes.** Volexity caught **UTA0576** chaining three zero-days, tracked in part as **CVE-2026-104935**, to get unauthenticated root on fully patched VPN appliances from October 3rd ([Volexity](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)). They went straight for Active Directory credentials, LAPS passwords and BitLocker recovery keys, without leaving a web shell behind. Another gateway story, one week after NetScaler. - **Atlassian: exploited two hours after the PoC.** watchTowr published a proof of concept for **CVE-2026-21589**, an unauthenticated file read across eight Data Center products that can leak Crowd credentials and lead to admin access. Exploitation attempts hit honeypots within about two hours ([BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-atlassian-flaw-after-public-poc-release/)). We ran the three attacking IPs: one is a commercial VPN exit, one sits on M247 hosting, and the third is on **Kaopu Cloud**, the same small provider behind the NetScaler exploitation IP in [Radar #13](/blog/reputation-radar-13). All three come back **investigate**. If you want the longer read on why a clean or popular result in the reputation column is a starting question rather than a verdict, we walked through it in [Borrowed reputation: when attackers hide behind trusted infrastructure](/blog/borrowed-reputation-cloud-phishing). See you next week. *Sources are linked inline, with credit to Bitdefender Labs for the Midnight Mimosa research and to the original researchers and reporters. If we got a detail wrong, tell us and we'll fix it.* > **About Reputation Radar:** This is written by the small team building Reput.io, not a marketing department. It's our weekly read on the infosec landscape, with a bias toward the thing we care most about: how attackers borrow the reputation of legitimate infrastructure so their traffic looks normal. Every item links the original reporting, and any claim about our own API is run against it live and labelled.