Counterfeit Android devices found preloaded with Triada malware

A new version of the Triada trojan has been discovered preinstalled on thousands of new Android devices, allowing threat actors to steal data as soon as they are set up. Kaspersky researchers report that this campaign mainly impacts Russian users, with at least 2,600 confirmed infections from March 13 to 27, 2025, based on visibility from its mobile protection tools. The security researchers noted that Triada was found on counterfeit versions of popular smartphone models sold at online stores at discounted prices to attract the interest of unsuspecting buyers. Triada is a modular Android malware first discovered in 2016, considered a pioneer at the time for operating almost entirely in the device's RAM to evade detection. Since then, there have been multiple reports of Triada hiding in the firmware of low-cost Android phones sold through dubious unofficial retail channels, making it a stealthy and also persistent threat that can't be removed without reflashing the ROM. Kaspersky's latest report indicates that the newest version of Triada remains highly evasive, hiding in Android's system framework and copying itself to every process on the smartphone. The latest Triada malware variant performs the following actions on infected devices: Transaction analysis shows that the new Triada trojan has stolen at least $270,000 worth of cryptocurrency. However, the total amount stolen by the operation is unknown as it also involves the hard-to-trace Monero cryptocurrency. Kaspersky isn...