The Hacker News reports that attackers have compromised open-source maintainer accounts…

SecurityWeek reports that Bitdefender found Midnight Mimosa, a campaign that ships malware preinstalled in the firmware of low-cost Android devices built on MediaTek platforms. The malware can silently install and remove apps, grant permissions, and load code remotely, and some related apps were also found on Google Play. Windows users should be cautious with cheap devices and avoid installing apps from untrusted sources.

Malwarebytes Labs reports that attackers compromised infrastructure behind the .gh, .sl, and .as country-code domain namespaces and used it to obtain unauthorized HTTPS certificates for Google domains and other organizations. Google blocked the certificates in Chrome and worked with certificate authorities to revoke them. Windows users should keep their browser and operating system updated and never bypass certificate warnings.

The Hacker News reports that 16 malicious Firefox extensions were found posing as Rabby and OKX Wallet tools to steal cryptocurrency wallet recovery phrases and private keys. The add-ons intercepted those secrets during wallet import flows and sent them to attacker-controlled Cloudflare Workers. Users who installed any of the extensions and entered a real recovery phrase or private key should assume compromise and move their assets from a clean system.