Triada malware discovered on counterfeit Android devices

Summary: Counterfeit Android phones are showing up preloaded with the Triada malware, a dangerous trojan that embeds itself deep into the system and can’t be removed without reflashing the ROM. Hackers use it to steal social media accounts, send fake messages, and even hijack cryptocurrency wallets. The next time you’re tempted by a suspiciously cheap phone online, think twice, it might cost you way more in the end.

There are counterfeit handbags, wallets, and shoes. But did you know there are counterfeit phones? Turns out there are, but if there is a good reason not to buy counterfeit devices, no matter how cheap they are, it is because they could come preloaded with Android malware.

Counterfeit Android smartphones

Kaspersky’s report revealed that a new version of the Triada malware came preinstalled on counterfeit Android devices in Russia. The researchers noted that counterfeit versions of popular-brand phones came preloaded with Triada. Online stores sold these devices at discounted prices, presumably to lure in customers. Unfortunately, this tactic worked.

The worst part about the Triada trojan? You can’t remove it unless you reflash the ROM. This isn’t terribly difficult, but the process might be a bit complicated for those who aren’t particularly technical.

Triada trojan risks

The Triada malware is also pretty insidious. It hides in the target’s phone and embeds itself into every process on the phone.

Hackers use the malware to steal accounts from messengers and social media platforms. They also use it to send and delete messages through apps like WhatsApp and Telegram. If you’ve ever received a weird message from a friend, there’s a good chance this is the reason why.

It also has financial risks, where it can hijack your cryptocurrency wallets and replace the address. This means that the crypto you receive will no longer go to your wallet, but the new address placed by the hacker. To date, Triada has managed to steal at least $270,000 worth of crypto.

Honestly, this isn’t a lot when you think about past incidents, but it’s still a substantial amount.

According to Dmitry Kalinin, a cybersecurity expert at Kaspersky Lab, “The Triada Trojan has been known for a long time, and it still remains one of the most complex and dangerous threats to Android. Its new version penetrates smartphone firmware even before the gadgets reach users. Probably, at one of the stages, the supply chain is compromised, so stores may not even suspect that they are selling smartphones with Triada.”

So, how do you protect yourself? For starters, don’t buy phones from unknown online stores with little to no track record. If it’s too cheap to be true, it probably isn’t worth the risk.

The post Triada malware discovered on counterfeit Android devices appeared first on Android Headlines.