Loading malware…
Triada is a sophisticated Android malware family first documented in 2016 that evolved from a rooting trojan into a modular backdoor embedded in system images and device firmware. It has been observed both as a preinstalled supply-chain infection on counterfeit or low-cost Android devices and inside trojanized third-party messaging app modifications, especially WhatsApp mods. Later variants were implanted directly into firmware during manufacturing or distribution, enabling persistence that can survive factory reset and giving the malware privileged execution very early in the Android process lifecycle.
A defining characteristic of Triada is deep system compromise. Historical variants used rooting techniques and code injection into browser and system components, while newer variants infect the Android Zygote process through malicious framework components and rogue native libraries. This causes attacker-controlled code to be injected into every application launched on the device, allowing Triada to operate inside target app contexts and abuse their permissions and data. The family has also been associated with replacement of system libraries and framework modifications to maintain persistence and execute modules across processes.
Triada is highly modular and supports delivery of app-specific payloads. Reported capabilities include downloading and executing additional modules, silently installing or uninstalling applications, blocking access to selected services, intercepting or manipulating browser traffic, and turning infected devices into reverse proxies. It has been used for ad fraud by installing spam or advertising apps and by replacing ads or links in browsers. More recent variants also support cryptocurrency theft by replacing wallet addresses in app fields, QR-code flows, and clipboard contents.
The family has extensive data-theft and account-compromise functionality. Documented modules target Telegram, WhatsApp, LINE, Skype, TikTok, Instagram, Facebook, browsers, SMS/MMS apps, Google Play, Google Play Services, and phone components. These modules have stolen authentication material, cookies, tokens, keys, session data, account identifiers, and message content; intercepted incoming SMS and MMS; extracted transaction data from SMS-based in-app purchases; sent arbitrary SMS messages; and deleted or altered evidence such as messages or notifications. Triada has also been reported to exfiltrate stolen data over HTTP POST to command-and-control infrastructure.
Triada has remained one of the most prevalent Android malware families in telemetry for multiple years, with numerous variants appearing among top mobile detections. Preinstalled variants such as Triada.z and Triada.ag have been especially prominent, while other variants have been embedded in modified messaging applications. Security research has described the family as one of the most advanced Android malware lineages because of its privileged persistence, process-wide injection model, and flexible plugin architecture. Some recent reporting noted code continuity with older Triada samples, Chinese-language developer comments, and possible infrastructure overlap with the Vo1d backdoor, but any firm attribution beyond those observations remains uncertain.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...redirect unsuspecting site users to ... malware, including an Android malware called Triada in one case."
36 distinct techniques documented for this family, organized by ATT&CK tactic.
Depending on which one was provided, the binary either 1) ran the command given as an argument as root or 2) concatenated all of the arguments, ran that concatenation preceded by sh, then ran them as root.
It registers a malicious receiver that, upon receiving intents, can execute arbitrary JavaScript code using WebView
After decryption, it is saved to disk as /data/data/%PACKAGE%/mms-core.jar and then loaded using DexClassLoader... The downloaded payload is decrypted... and loaded via DexClassLoader
We discovered that the suspicious library was loaded into Zygote, the parent process for every Android application, by an infected AOT-compiled Android system framework (boot-framework.oat)
This class registers a receiver that allows other modules to install arbitrary APKs on the device and also uninstall any apps
We discovered that the suspicious library was loaded into Zygote, the parent process for every Android application, by an infected AOT-compiled Android system framework (boot-framework.oat)
We conducted an investigation, discovering a new version of the BADBOX backdoor, preloaded on the device. This backdoor is a multi-level loader embedded in a malicious native library, librescache.so, which was loaded by the system framework. As a result, a copy of the Trojan infiltrated every process running on the device.
This module undergoes a double XOR decryption process... After downloading, the modules were decrypted twice using XOR with different keys
All field values within the configuration are encrypted using AES-128 in ECB mode and then encoded with Base64... The infected device receives the key and initialization vector (IV) RSA-encrypted from the C2
We conducted an investigation, discovering a new version of the BADBOX backdoor, preloaded on the device. This backdoor is a multi-level loader embedded in a malicious native library, librescache.so, which was loaded by the system framework. As a result, a copy of the Trojan infiltrated every process running on the device.
Once the loading is complete, the payload file is deleted... If the message text matches regular expressions received by the Trojan from the C2 server, the message is deleted from the client... Delete sent messages on the device to cover its tracks
Этот модуль дважды расшифровывается XOR-методом с разными ключами... Все значения полей в конфигурации зашифрованы алгоритмом AES-128... Модули после скачивания дважды расшифровывались с помощью XOR
binder.so registers native methods that can intercept calls to arbitrary methods within the process where the malware is running... the malware uses reflection to replace the Instrumentation class instance for the app
the Trojan then swaps the crypto wallet address with a hardcoded one and replaces the click handlers of all buttons in the application with a proxy handler... replaces image elements with generated QR codes
В нем хранятся данные для авторизации в Telegram, в том числе токен... с помощью рефлексии он получает токен доступа приложения... пытается извлечь токен, позволяющий получить доступ к учетной записи Skype
This file contains the cookies for active Instagram sessions... the malware steals the Facebook authentication cookies... designed for stealing Instagram cookies from web browsers
читает строку с ключом user... содержимое файла tgnet.dat... строку с id = 1 из таблицы params в базе данных cache4.db... собирает все файлы
Whenever it had to send a request to the Command and Control (C&C) server, it encrypted the request using two XOR loops with different passwords.
зловред регулярно отправляет запросы на командный сервер... В ответ C2 возвращает JSON... Сначала он устанавливает связь с C2 поверх TCP-сокетов
the malware periodically transmits a wealth of device information... to its command-and-control server... The C2 responds with a JSON file
the main purpose of this module is to turn the infected device into a reverse proxy, essentially giving the attackers network access through the victim’s device
First, it establishes a connection with the C2 server over TCP sockets... The server responds with an IP address and port, which the malware uses to listen for commands
76 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android malware family appearing prominently in Q2 2026 detection rankings, represented by multiple backdoor and trojan variants among the most frequently detected mobile threats.
Android malware family appearing in multiple backdoor and trojan variants and prominently represented in the quarter's top mobile malware detections.
Android malware family appearing in both backdoor and trojan detections, with multiple variants among the most frequently detected mobile malware in the quarter.
Android malware/trojan referenced as being preinstalled on smartphones out of the box.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.