Android Phones Preloaded With Crypto Malware

Counterfeit Android Phones Preloaded with Triada Malware

• Over 2,600 users encountered the Triada Trojan between March 13 and 27, 2025.
• The malware can steal cryptocurrency, hijack social media accounts, and replace phone numbers during calls.
• Triada gains root access to devices, injecting malicious code into system processes like Zygote.
• The malware is deeply embedded in counterfeit smartphones’ system frameworks, making detection difficult.
• Triada emerged in 2016 and has evolved into a complex threat targeting Android users.

The Triada Trojan has affected over 2,600 users within two weeks in March 2025. It compromises counterfeit Android phones by stealing sensitive data and altering communications undetected.