Loading story…
The Android malware xHelper was found using a multi-stage infection chain that lets it survive app removal and even some factory resets by gaining root privileges and embedding itself into the system partition. Disguised as a cleaner app, xHelper hides after installation, gathers device information, and downloads additional modules including Agent.of, Helper.b, Leech.p, and Triada, which work together to obtain elevated access and install persistent components.
Researchers reported that the malware modifies /system/lib/libc.so, sets immutable file attributes, reinstalls itself from a system-partition package, and can remove root-management tools such as Superuser, making remediation difficult. The infection effectively leaves a backdoor capable of superuser command execution and broad access to application data, giving attackers deep control over compromised devices. Recommended recovery is to replace the altered libc.so with a clean version from original firmware where possible, though a full device reflash is considered the more reliable fix, especially because some affected phones may already carry malware in preinstalled firmware.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Securelist states that xHelper remained highly active after mass attacks began in the middle of the previous year, establishing the start of the large-scale campaign. The malware was characterized by strong persistence on infected Android devices.
Securelist analyzed an active xHelper sample and described how it masquerades as a cleaner app, downloads multiple malicious stages including Agent.of, Helper.b, Leech.p, and Triada, gains root on some devices, modifies the system partition, and survives deletion or factory reset. The report also noted that the malware can install a superuser backdoor and recommended replacing the infected libc.so or fully reflashing affected phones.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that a significant share of Android infections stemmed from malware and adware embedded in the **system partition** or shipped in device firmware, particularly on low-cost smartphones and tablets. Because these components reside in protected system areas, they are difficult to remove without reflashing the device and can survive normal cleanup efforts. The report said **14.8%** of users hit by malware or adware over the prior year had infections in the system partition, with prevalence reaching **27%** for some budget vendors. Researchers identified two main infection paths: malware that gains root access and installs itself into system directories, and ad-related code inserted into firmware before devices are sold. Threats observed included **Triada**, **Lezok**, **Agent.pe**, **Sivu.c**, **Plague.f**, **Agent.pac**, **Penguin.e**, **Necro.d**, **Facmod.a**, **Guerrilla.i**, **Virtualinst.c**, and **Secretad.c**, which were linked to silent app installation, intrusive advertising, code downloading, and remote control capabilities. The report also highlighted adware-like behavior in some **Meizu** apps and the widespread presence of the `/bin/fotabinder` binary, which could download and execute code from remote servers, underscoring supply-chain security risks in budget Android devices.
Aug 14, 2026
Researchers reported a large Android supply-chain compromise in which devices from more than 50 brands were shipped with malware embedded in firmware, allowing attackers to control phones before users installed any apps. Trend Micro said the operation, attributed to **Lemon Group**, implanted **Guerrilla** malware through a tampered zygote-related library and used a core plugin called **Sloth** to fetch modules for SMS interception, proxying, cookie theft, WhatsApp abuse, ad fraud, and silent app installation. Telemetry and actor-hosted data indicated activity across more than 180 countries, hundreds of thousands of mobile numbers used for OTP requests, and millions of potentially affected devices, with the business later rebranded in part from Lemon SMS to Durian Cloud SMS while keeping backend infrastructure. The findings echo earlier reporting on **Triada**, an Android malware family that evolved from a rooting trojan into a preinstalled system-image backdoor embedded in framework components. Google previously said Triada abused privileged contexts such as **System UI** and **Google Play** to execute code, monitor foreground apps, replace ads, and install applications so they appeared to come from Google Play, and that infections were inserted into device images during production by a third party using the names **Yehuo** or **Blazefire**. Trend Micro said the newer Guerrilla campaign showed infrastructure overlap with Triada operators, suggesting a continuing ecosystem of firmware-level Android compromise monetized through fraud, silent installs, and persistent device backdoors.
Aug 21, 2026
Researchers tied multiple Android threats to the **Ztorg** malware family, including trojanized apps such as **"Cool Video Player," "Magic browser,"** and **"Noise Detector"**. The malware used anti-analysis checks to avoid Android SDK emulators and common sandbox environments, then contacted command-and-control servers including `bbs.tihalf.com` and `alla.tihalf.com` with encrypted device data. In one infection chain, the app decrypted server responses, downloaded a secondary APK, decoded it, stored it as `dba.jar`, and loaded it invisibly with `DexClassLoader`, confirming a staged delivery model designed to hide malicious behavior from users and analysts. Separate Ztorg-linked samples distributed through Google Play were installed more than **60,000** times before removal and shifted monetization from rooting toward **premium SMS fraud** and likely **WAP billing abuse**, using IMSI-derived carrier data to tailor activity by country and operator. Other Ztorg payloads went further by lowering **SELinux** protections, attempting to root devices, replacing system binaries such as `/system/bin/debuggerd`, and silently installing additional apps and executables for persistence. Analysts said the family combined obfuscation, encrypted payload delivery, rooting components, and stealthy monetization modules, making infections difficult to detect and remove.
Aug 15, 2026