Triada Android Trojan Hijacks Zygote for System-Wide App Injection and SMS Fraud

Researchers detailed Triada, a modular Android Trojan that gains unauthorized root privileges through an ecosystem of rooting malware and ad-fraud botnets, then embeds itself in system application directories to survive reboots and evade removal. The malware downloads additional modules directly into memory, collects device identifiers and installed-app data, and communicates with hard-coded command-and-control servers while storing encrypted configuration data locally.

Triada’s most notable capability is patching Android’s Zygote process so its code is injected into nearly every app launched on an infected device, giving it broad visibility and control across the system. Operators used that access to monetize infections through SMS fraud, intercepting and altering outgoing messages tied to in-app payments so charges were redirected to attacker-controlled numbers, while filtering incoming SMS and hiding malicious packages, processes, and services from users and security tools.