Dodgy Android smartphones are being preloaded with Triada malware

2 weeks ago 2

Malware kan ställa till med oreda (Image credit: Shutterstock)

Kaspersky uncovers counterfeit Android smartphones preloaded with Triada malware
The researchers speculate the supply chain might have been compromised
More than $270,000 in crypto has already been stolen

Counterfeit versions of popular Android smartphones are being sold with malware pre-installed, experts have revealed.

Cybersecurity researchers Kaspersky have warned users about buying heavily discounted Android smartphones from shady online stores after it observed at least 2,600 victims, located mostly in Russia, who received their brand-new smartphones carrying the Triada Trojan.

“The new version of the malware is found in the firmware of infected Android devices,” reads the machine-translated announcement. “It is located in system framework, meaning a copy of Triada makes its way into every process on your smartphone.”

Targeting journalists

The malware was said to have a wide range of functionalities and can give the attacker “almost unlimited possibilities” for controlling the compromised devices.

Among other things, Triada can steal user accounts in messengers and social networks, stealthily send messages on behalf of the victim, steal cryptocurrencies, monitor the victim’s browser activities, replace links, swap numbers during calls, monitor and intercept SMS messages, download and run apps, and block network connections.

Dmitry Kalinin, cybersecurity expert at Kaspersky Lab, said Triada remains “one of the most sophisticated and dangerous threats to Android,” but added that the researchers don’t really know how the devices got infected.

“It’s possible that one of the stages in the supply chain is compromised,” he said, “so the stores selling the devices may not even suspect that they’re selling Triada-infected devices.”

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

These thousands of victims have already suffered hundreds of thousands of dollars in losses, the researchers concluded.

Kaspersky claims around $270,000 in cryptocurrency was already siphoned out, suggesting that the number could be even greater since some of the transactions were made in difficult-to-trace Monero.

The best way to avoid this risk is to only buy smartphones from authorized sellers. Alternatively, users could reflash their device using a clean system image from Google.

Via BleepingComputer

Private API keys and passwords found in AI training dataset - nearly 12,000 details leaked
We've rounded up the best password managers
Take a look at our guide to the best authenticator app

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read Entire Article