Loading story…
Researchers found the Android Trojan Triada embedded in the modified WhatsApp client FMWhatsApp 16.80.0 through a compromised advertising SDK. Detected as Trojan.AndroidOS.Triada.ef, the malware collects device identifiers and installed app package data, registers infected devices with a remote server, and then downloads, decrypts, and executes additional malicious components on the handset.
Observed follow-on payloads included downloaders, ad-fraud modules, premium-subscription fraud malware, and a component capable of registering a victim’s WhatsApp account on attacker-controlled infrastructure. Because users of the modded app commonly grant SMS-reading permissions, the malware can intercept verification codes, automate fraudulent premium-service signups, and support WhatsApp account takeover-related activity.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Technical analysis showed that downloaded modules could sign victims up for paid subscriptions, display fraudulent ads, and abuse SMS-reading permissions to intercept confirmation codes. One payload, Trojan.AndroidOS.Whatreg.b, could request WhatsApp verification codes and support sign-in activity on attacker-controlled infrastructure.
Researchers observed the embedded Triada component collecting device and package information, registering infected devices with a remote server, and downloading, decrypting, and launching additional payloads. Identified payloads included Agent.ic, Gapac.e, Helper.a, MobOk.i, Subscriber.l, and Whatreg.b.
Kaspersky researchers found that the unofficial Android app FMWhatsapp version 16.80.0 contained the Triada Trojan embedded alongside an advertising SDK. The malicious component was detected as Trojan.AndroidOS.Triada.ef.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Triada**, a modular Android Trojan that gains unauthorized root privileges through an ecosystem of rooting malware and ad-fraud botnets, then embeds itself in system application directories to survive reboots and evade removal. The malware downloads additional modules directly into memory, collects device identifiers and installed-app data, and communicates with hard-coded command-and-control servers while storing encrypted configuration data locally. Triada’s most notable capability is patching Android’s **Zygote** process so its code is injected into nearly every app launched on an infected device, giving it broad visibility and control across the system. Operators used that access to monetize infections through **SMS fraud**, intercepting and altering outgoing messages tied to in-app payments so charges were redirected to attacker-controlled numbers, while filtering incoming SMS and hiding malicious packages, processes, and services from users and security tools.
Aug 14, 2026
Researchers reported that a malicious modified version of WhatsApp was being distributed through seemingly legitimate Android applications, allowing attackers to compromise users who installed the software outside official channels. The campaign relied on repackaged apps that appeared benign but delivered a trojanized WhatsApp mod, expanding the reach of malware through trusted-looking distribution paths rather than direct phishing alone. The activity highlights the risk posed by unofficial messaging clients and third-party app ecosystems, where attackers can hide malware inside popular software variants to steal data, abuse device access, or deploy additional payloads. The incident underscores that users and organizations should restrict installations to official app stores and vetted software sources, especially for high-use communications platforms such as **WhatsApp**.
Jul 12, 2026
Researchers reported a large Android supply-chain compromise in which devices from more than 50 brands were shipped with malware embedded in firmware, allowing attackers to control phones before users installed any apps. Trend Micro said the operation, attributed to **Lemon Group**, implanted **Guerrilla** malware through a tampered zygote-related library and used a core plugin called **Sloth** to fetch modules for SMS interception, proxying, cookie theft, WhatsApp abuse, ad fraud, and silent app installation. Telemetry and actor-hosted data indicated activity across more than 180 countries, hundreds of thousands of mobile numbers used for OTP requests, and millions of potentially affected devices, with the business later rebranded in part from Lemon SMS to Durian Cloud SMS while keeping backend infrastructure. The findings echo earlier reporting on **Triada**, an Android malware family that evolved from a rooting trojan into a preinstalled system-image backdoor embedded in framework components. Google previously said Triada abused privileged contexts such as **System UI** and **Google Play** to execute code, monitor foreground apps, replace ads, and install applications so they appeared to come from Google Play, and that infections were inserted into device images during production by a third party using the names **Yehuo** or **Blazefire**. Trend Micro said the newer Guerrilla campaign showed infrastructure overlap with Triada operators, suggesting a continuing ecosystem of firmware-level Android compromise monetized through fraud, silent installs, and persistent device backdoors.
Aug 21, 2026