Loading story…
Motorola smartphones in the United States were found to intercept launches of the native Amazon Shopping app and briefly route users through a browser-based affiliate tracking link before opening Amazon. Researchers and users traced the behavior to Smart Feed, a preinstalled system component tied to an app recommendation or search feature, with network analysis linking requests to devicenative[.]com. The redirect reportedly hijacked launcher intents and injected an Amazon Associate referral token without user awareness, creating privacy, integrity, and undisclosed monetization concerns on affected devices, including the Motorola Razr 60 Ultra.
Technical scrutiny found the redirect was often invisible unless Android link-handling settings exposed the browser hop, but researchers warned the same server-side mechanism could theoretically be repurposed for phishing or credential-harvesting without a firmware update. Additional concern focused on the redirect infrastructure, including a domain said to have been registered only days earlier and tied in registration records to an independent fashion marketing blogger, raising insider-threat questions. Motorola later said the behavior was unintended, called it a configuration error, and stated it had corrected the routing so apps now launch directly, while backlash continued over the adware-like design and supply-chain trust implications.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Motorola stated that the redirect behavior was unintended and caused by a configuration error in an application recommendation or search feature developed with a third-party advertising affiliate. The company said it quickly corrected the routing so affected apps now launch directly, ending the affiliate redirect behavior.
Subsequent analysis linked the behavior to the preinstalled Smart Feed app, which intercepted Amazon app launches and sent requests through affiliate-tracking infrastructure including devicenative[.]com. Researchers also noted suspicious characteristics around the redirect setup, including a domain reportedly registered three days earlier and tied in registration records to an independent fashion marketing blogger.
A Motorola Razr 60 Ultra user reported that launching the native Amazon Shopping app triggered a brief browser-based redirect through an affiliate tracking link before opening Amazon. This observation led to further scrutiny of Motorola's preinstalled Smart Feed component.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that a significant share of Android infections stemmed from malware and adware embedded in the **system partition** or shipped in device firmware, particularly on low-cost smartphones and tablets. Because these components reside in protected system areas, they are difficult to remove without reflashing the device and can survive normal cleanup efforts. The report said **14.8%** of users hit by malware or adware over the prior year had infections in the system partition, with prevalence reaching **27%** for some budget vendors. Researchers identified two main infection paths: malware that gains root access and installs itself into system directories, and ad-related code inserted into firmware before devices are sold. Threats observed included **Triada**, **Lezok**, **Agent.pe**, **Sivu.c**, **Plague.f**, **Agent.pac**, **Penguin.e**, **Necro.d**, **Facmod.a**, **Guerrilla.i**, **Virtualinst.c**, and **Secretad.c**, which were linked to silent app installation, intrusive advertising, code downloading, and remote control capabilities. The report also highlighted adware-like behavior in some **Meizu** apps and the widespread presence of the `/bin/fotabinder` binary, which could download and execute code from remote servers, underscoring supply-chain security risks in budget Android devices.
Aug 14, 2026
Kaspersky reported that a **Triada** Android malware module was hijacking mobile web traffic through browser URL spoofing after gaining superuser privileges on infected devices. Detected as `Backdoor.AndroidOS.Triada.p`, `Backdoor.AndroidOS.Triada.o`, and `Backdoor.AndroidOS.Triada.q`, the module injected a DLL into browser processes and then downloaded URL-rewrite rules from its command-and-control infrastructure to silently alter where victims were sent online. The activity was observed redirecting users by changing default search engines and browser home pages, but the same mechanism could also be used to send victims visiting banking sites to phishing pages controlled by attackers. Kaspersky said the campaign affected **247 users** during the observation period and found no indication that the operation was slowing, underscoring the risk of persistent mobile malware capable of covert traffic manipulation.
Aug 15, 2026
Researchers reported that the **Roaming Mantis** campaign hijacked DNS settings on compromised routers and redirected users to malicious landing pages that pushed Android malware. Victims who attempted to browse the web while connected to affected networks were instead shown fake update prompts, allowing the attackers to install malware on Android devices and potentially harvest credentials and other sensitive data. The operation stood out because it abused home and small-office networking infrastructure rather than relying solely on phishing or malicious apps. By tampering with router DNS configurations, the attackers were able to intercept traffic at the network level and selectively deliver malicious content to mobile users, expanding the reach of the campaign and demonstrating how router compromise can be used to spread malware across connected devices.
Jul 12, 2026