Counterfeit Android devices found preloaded With Triada malware

A new version of the Triada trojan has been discovered preinstalled on thousands of new Android devices, allowing threat actors to steal data as soon as they are set up. Kaspersky researchers report that this campaign mainly impacts Russian users, with at least 2,600 confirmed infections from March 13 to 27, 2025, based on visibility from its mobile protection tools. The security researchers noted that Triada was found on counterfeit versions of popular smartphone models sold at online stores at discounted prices to attract the interest of unsuspecting buyers. Triada is a modular Android malware first discovered in 2016, considered a pioneer at the time for operating almost entirely in the device's RAM to evade detection. Since then, there have been multiple reports of Triada hiding in the firmware of low-cost Android phones sold through dubious unofficial retail channels, making it a stealthy and also persistent threat that can't be removed without reflashing the ROM. Kaspersky's ... Read full article.