Hi, everyone,
I'm a professional programmer and hobbyist security researcher. My secondary phone, the Maxwest Nitro A65, was infected with Triada malware by a security update a couple months ago. It's on your list of devices affected by Midnight Mimosa, but I discovered this before your article on Midnight Mimosa was published, and Midnight Mimosa is actually downloaded by Triada - see my other post:
My blog post with a full writeup and the malicious libandroid_runtime.so file is here:
https://ethannelson-moore.github.io/blog/2026/10/25/maxwest-nitro-a65-triada/
I reported this to Google through multiple avenues and received either no response or nonsensical responses. I also tried to contact Maxwest Telecom but never received a response. The phone has not received an update to remove the malware. It is still on Google's list of certified Android devices, and Google Play Protect still reports it as certified. The phone is currently being sold at a deep discount as part of the US government-subsidized Lifeline program which provides phones to people who could not otherwise afford them.
Do you have any internal contacts at Google where you could raise this issue, since my reports are not being handled correctly?
Google heavily advertises the security and safety of certified Android devices, stating the following (emphasis mine):
We provide hundreds of tests to ensure Play Protect certified devices adhere to the Android security and permissions model and have software builds with recent security updates. Play Protect certified devices are also required to ship without pre-installed malware and include Google Play Protect, a suite of security features such as automatic virus scanning and Find My Device. This provides baseline protection against malware, privacy hacks and more.
Unfortunately, Google's certification process is not living up to that promise. It is clear that Google's existing checks for preinstalled malware, for example via the Build Test Suite, are failing to catch new strains of malware. Owners of Android devices, regardless of how much they paid for their device, deserve to have their personal data protected.
Google also has a history of working with OEMs to remove Triada: https://security.googleblog.com/2019/06/pha-family-highlights-triada.html
