Android Security, Midnight Mimosa, Malware, One UI 9, Galaxy A36, Google Play Services, Gemini Notebook,
Today’s biggest Android story is a warning for anyone shopping at the cheap end of the market: researchers say a malware campaign called Midnight Mimosa has been baked into the firmware of low-cost phones sold worldwide. Elsewhere, Google is pushing call-scam protections to older Android versions through Play services, Samsung’s One UI 9 reaches more Galaxy A phones in the US, and Samsung has reclaimed the top spot in India.
Midnight Mimosa Malware Ships Preinstalled on Budget Android Phones
Security researchers are raising the alarm over Midnight Mimosa, a campaign that hides a malicious system app inside the firmware of low-cost, MediaTek-based Android phones before buyers ever switch them on. New reporting this week, drawing on Bitdefender’s investigation, says infections have been observed over roughly two years in more than 150 countries, with the highest counts in Mexico, France and Italy, followed by the US, Germany, Brazil and Spain. Affected handsets include cheap phones and counterfeit “flagship” models, some reporting identifiers tied to Doogee and Cubot.
Because the component is signed with a platform certificate, it can silently install and remove apps, grant permissions and pull down plugins that run ad fraud or turn the phone into a residential proxy. Researchers also linked 13 related ad-fraud apps to Google Play. A normal uninstall may not remove the firmware piece, so the safest advice is to avoid suspiciously cheap phones that borrow big-brand model names.
Source:
Cybersecurity News | Bitdefender (original research)
Google Play Services v26.41 Brings Call-Scam Protection to Older Android Versions
Google’s October system update notes list Google Play services v26.41, which extends in-call scam protections to devices running Android 15 and earlier. The same release adds Left-Behind Reminders to Find Hub, smoother Fast Pair firmware updates for accessories, and Aadhaar support as a digital ID in Google Wallet. Play Store v53.7 also puts device offers at the top of Apps Home and shows time or size remaining on downloads instead of a percentage.
This matters because Play services reaches phones that no longer get full OS upgrades, so older devices pick up meaningful anti-scam features without waiting on their manufacturer. As always, a changelog entry doesn’t mean the feature is live for everyone yet, so expect a gradual rollout.
Source:
9to5Google
Update: One UI 9 Reaches the Galaxy A36 and Galaxy A37 in the US
Building on last week’s Android 17 rollout to the Galaxy S23 series, Samsung has now pushed the stable One UI 9 update to the carrier-locked Galaxy A36 in the US (firmware A366USQUADZIF, with the September 2026 security patch), and the Galaxy A37 is getting it in the US as well. The unlocked A36 model is still waiting its turn.
The update brings more Quick Panel and lock screen clock customization, a redesigned Samsung Health interface, a new LLM-powered Bixby and a Warranty and care section in Settings. It’s a good sign for US midrange owners, who are getting Android 17 relatively early in Samsung’s rollout.
Source:
SamMobile | SamMobile (Galaxy A37)
Samsung Is India’s Top Phone Brand Again as the Market Slumps 26%
Omdia’s Q3 2026 figures put Samsung back at No. 1 in India with 6.7 million shipments and roughly a 19% share, the first time it has led since Q1 2024. vivo follows at 18%, ahead of Oppo, Xiaomi and Apple.
The wider picture is gloomier: total shipments fell 26% year-on-year to 35.8 million units, the weakest third quarter since 2016, which Omdia ties to higher prices and cautious spending. Rivals saw steep declines while Samsung’s shipments held nearly flat, and Omdia expects another small market decline in 2027, so Indian buyers should expect price pressure to continue.
Gemini Notebook Adds Co-Creation for Slides and Video Overviews
Google is adding a guided “co-creation” flow to Gemini Notebook’s Slide Decks and Video Overviews. Instead of producing a finished deck straight from a prompt, Notebook first suggests topics, then asks you to pick a format and visual style, and an optional review step lets you edit the outline or producer notes before anything is generated.
Google says the feature is rolling out globally to all Gemini Notebook users over the coming week. It’s a small but useful shift toward giving users more control over AI output, rather than having to regenerate until the result looks right.
Source:
Google Blog | Android Authority
Spotted in Testing: Android Auto Work Account Support
Note: This feature was found in a test build and is not officially announced. It may change or never launch.
An unreleased Android Auto build (18.0.664204) includes a Work Account option in the Quick Settings tile; turning it on adds a briefcase icon over the app drawer. The feature isn’t fully working yet, and Google hasn’t announced it.
Android Auto has never officially supported work profiles, so this could be handy for people who drive company vehicles or keep work apps separate on their phones. Treat it as an early test, not a confirmed feature.
Source:
9to5Google
Bottom Line
The Midnight Mimosa findings are the story to act on today: if you’re buying a budget phone, stick to known brands and trusted sellers. Google’s Play services update is the quiet win for owners of older devices, while One UI 9’s spread to the Galaxy A36 and A37 shows Samsung’s Android 17 rollout is moving quickly down its range.