Dodgy Android smartphones are being preloaded with Triada malware

Victims have already lost hundreds of thousands of dollars

News By Sead Fadilpašić published 3 April 2025

Malware kan ställa till med oreda (Image credit: Shutterstock)

• Kaspersky uncovers counterfeit Android smartphones preloaded with Triada malware
• The researchers speculate the supply chain might have been compromised
• More than $270,000 in crypto has already been stolen

Counterfeit versions of popular Android smartphones are being sold with malware pre-installed, experts have revealed.

Cybersecurity researchers Kaspersky have warned users about buying heavily discounted Android smartphones from shady online stores after it observed at least 2,600 victims, located mostly in Russia, who received their brand-new smartphones carrying the Triada Trojan.

“The new version of the malware is found in the firmware of infected Android devices,” reads the machine-translated announcement. “It is located in system framework, meaning a copy of Triada makes its way into every process on your smartphone.”

Monitor your credit score with TransUnion starting at $29.95/month

TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnion’s advanced risk assessment tools.

Preferred partner (What does this mean?)

View Deal

Targeting journalists

The malware was said to have a wide range of functionalities and can give the attacker “almost unlimited possibilities” for controlling the compromised devices.

Among other things, Triada can steal user accounts in messengers and social networks, stealthily send messages on behalf of the victim, steal cryptocurrencies, monitor the victim’s browser activities, replace links, swap numbers during calls, monitor and intercept SMS messages, download and run apps, and block network connections.

Dmitry Kalinin, cybersecurity expert at Kaspersky Lab, said Triada remains “one of the most sophisticated and dangerous threats to Android,” but added that the researchers don’t really know how the devices got infected.

“It’s possible that one of the stages in the supply chain is compromised,” he said, “so the stores selling the devices may not even suspect that they’re selling Triada-infected devices.”

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors