Kaspersky Lab has issued a warning about counterfeit models of popular Android smartphones appearing in unofficial online stores. These devices are infected with a new version of the Triada trojan, posing a threat to user security. The company’s statement was reported by RBC.
The malware is embedded in the device’s firmware, allowing it to control every process. The trojan can steal cryptocurrency, accounts in messaging apps and social networks, particularly in Telegram and TikTok, send messages, alter numbers during calls, monitor victim activity in browsers, and block network connections.
Experts suggest that at some point, the supply chain of cheap counterfeit smartphones to unauthorized stores is compromised, meaning sellers may be unaware of the devices’ infection.
More than 2,600 users in various countries, primarily in Russia, have already fallen victim to this scheme. From June 2024 to March 2025, the creators of Triada received approximately $270,000 in various cryptocurrencies. The actual damage could be higher.
Back in 2019, Triada was already the most widespread malware for mobile devices.
Earlier, ForkLog reported on a new family of trojans called Crocodilus, which steals funds from banking apps and crypto wallets.