Exploit-DB RSS Feed

Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Kaspersky researchers have discovered a new version of the Triada Trojan being distributed through infected Android device firmware. The malware is embedded into system files before devices are sold, making it nearly impossible to remove. It infects the Zygote process to compromise all apps on the device. The Trojan's modular architecture allows attackers to deliver targeted payloads for stealing cryptocurrency, credentials, and other sensitive data from popular apps like WhatsApp, Facebook, and banking apps. It can also intercept SMS messages, make calls, and act as a reverse proxy. Over 4,500 infected devices have been detected worldwide, with the highest numbers in Russia, UK, Netherlands, Germany and Brazil. The attackers have stolen over $264,000 in cryptocurrency so far.

The Triada Trojan is a sophisticated Android malware strain that has evolved to be embedded directly into the firmware of infected devices prior to sale. This new version discovered by Kaspersky researchers leverages firmware-level infection, making it extremely persistent and difficult to remove through conventional means such as factory resets or app uninstallations. The malware compromises the Zygote process, which is the core Android process responsible for launching all apps. By infecting Zygote, Triada gains the ability to inject malicious code into every app running on the device, thereby achieving system-wide control and surveillance capabilities. Its modular architecture allows attackers to dynamically load and execute targeted payloads tailored to steal sensitive information from popular applications including WhatsApp, Facebook, and various banking apps. The Trojan can intercept SMS messages, make unauthorized calls, and operate as a reverse proxy, enabling attackers to relay traffic and potentially bypass network security controls. Over 4,500 infected devices have been identified globally, with significant concentrations in Russia, the United Kingdom, the Netherlands, Germany, and Brazil. Financially, the attackers have successfully stolen over $264,000 in cryptocurrency, highlighting the malware’s effectiveness in targeting digital assets. The infection vector through firmware embedding indicates a supply chain compromise or malicious firmware pre-installation, which poses a serious challenge for detection and remediation. The malware’s capabilities align with several MITRE ATT&CK techniques including credential dumping (T1552.001), input capture (T1056.001), data from local system (T1570), and command and control via reverse proxy (T1041). Given its stealth, persistence, and broad impact on confidentiality and integrity, Triada represents a significant threat to Android device users and organizations relying on these devices for secure communications and transactions.

Detailed information about A new version of Triada spreads embedded in the firmware of Android devices. Get real-time updates, technical details, and mitigation

Title	Severity	Type	Source	Date

Threats Tagged 'sms interception'

Filter Threats

Threats Tagged 'sms interception'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility