Thousands of Android Phones Found With Preinstalled Malware That Steals Data Right Away

A new version of the Triada trojan has been discovered preinstalled on thousands of Android devices, giving cybercriminals the ability to steal data as soon as the devices are set up. According to Kaspersky researchers, this malware campaign has primarily targeted Russian users, with at least 2,600 infections reported between March 13 and 27, 2025. These infections were identified through Kaspersky's mobile protection tools.

Triada was found on fake versions of popular smartphone models sold online at lower prices. These low-cost devices attract unsuspecting buyers who may not realize they are purchasing compromised products. The malware was first discovered in 2016 and has changed over time. It now hides in Android phone firmware. This makes it a constant threat because you cannot remove it unless you reflash the device's software, as reported by Bleeping Computer.

The latest version of Triada is very hard to detect. It hides ...