#triada trojan

A banking trojan was found to come pre-installed in some old budget Android smartphones including some from Cherry Mobile, Leagoo, and Doogee. The malware goes by the name Triada and was first discovered in 2016. According to Google, its purpose is to install spam apps on a device by gaining root access, but as Google Play Protect strengthened defenses against rooting exploits, Triada apps were forced to adapt. In a report by HackRead, developers of the Triada malware changed their strategy in 2017 and evolved Triada into a system image backdoor and was able to install it on devices during the supply chain process. According to Dr.Web's post in March 2018, Triada has infected over 40 Android devices. "By working with the OEMs and supplying them with instructions for removing the threat from devices, we reduced the spread of preinstalled Triada variants and removed infections from the devices through the OTA updates," said Lukasz Siewierski, Android Security & Privacy Team. "The Triada case is a good example of how Android malware authors are becoming more adept. Read more in our articles including "Malware found pre-installed in some budget Android smartphones" and "Qualcomm Snapdragon 6 Gen 5, Snapdragon 4 Gen 5 announced".