Loading story…
Security researchers reported that a significant share of Android infections stemmed from malware and adware embedded in the system partition or shipped in device firmware, particularly on low-cost smartphones and tablets. Because these components reside in protected system areas, they are difficult to remove without reflashing the device and can survive normal cleanup efforts. The report said 14.8% of users hit by malware or adware over the prior year had infections in the system partition, with prevalence reaching 27% for some budget vendors.
Researchers identified two main infection paths: malware that gains root access and installs itself into system directories, and ad-related code inserted into firmware before devices are sold. Threats observed included Triada, Lezok, Agent.pe, Sivu.c, Plague.f, Agent.pac, Penguin.e, Necro.d, Facmod.a, Guerrilla.i, Virtualinst.c, and Secretad.c, which were linked to silent app installation, intrusive advertising, code downloading, and remote control capabilities. The report also highlighted adware-like behavior in some Meizu apps and the widespread presence of the /bin/fotabinder binary, which could download and execute code from remote servers, underscoring supply-chain security risks in budget Android devices.
Trace attribution and downstream blast radius.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published an analysis of Android adware and malware embedded in device system partitions or preinstalled firmware, describing how such threats are difficult or risky for users to remove. The report identified common families including Triada, Lezok, Agent.pe, Sivu.c, Plague.f, Agent.pac, Penguin.e, Necro.d, Facmod.a, Guerrilla.i, Virtualinst.c, and Secretad.c, and said some low-cost vendors preinstall adware as part of their business model.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security researchers have reported a significant escalation in Android-targeted threats, including the discovery of new malware families, pre-installed trojans, and spyware on both counterfeit and budget smartphones. The Triada trojan continues to be found pre-installed on counterfeit Android devices, granting attackers full device control and enabling credential theft, botnet enrollment, and unauthorized access to sensitive apps. In parallel, certain budget Samsung phones have reportedly shipped with an unremovable system app, AppCloud, described as spyware that collects sensitive user data and cannot be removed without voiding the warranty. These findings highlight the persistent risks associated with purchasing devices from untrusted sources and the growing sophistication of supply chain threats. The overall threat landscape for Android users has intensified in 2025, with a marked increase in malware, adware, and potentially unwanted program (PUP) detections. Attackers are shifting from nuisance apps to more covert tools capable of harvesting data, intercepting messages, and facilitating account takeovers. The rise in SMS-based attacks and the integration of advanced capabilities, such as one-time passcode theft, underscore the need for heightened vigilance and robust mobile security practices. Security experts emphasize the importance of verifying device integrity, using only official firmware, and implementing strict security policies to mitigate these evolving threats.
Jun 29, 2026
Researchers reported a large Android supply-chain compromise in which devices from more than 50 brands were shipped with malware embedded in firmware, allowing attackers to control phones before users installed any apps. Trend Micro said the operation, attributed to **Lemon Group**, implanted **Guerrilla** malware through a tampered zygote-related library and used a core plugin called **Sloth** to fetch modules for SMS interception, proxying, cookie theft, WhatsApp abuse, ad fraud, and silent app installation. Telemetry and actor-hosted data indicated activity across more than 180 countries, hundreds of thousands of mobile numbers used for OTP requests, and millions of potentially affected devices, with the business later rebranded in part from Lemon SMS to Durian Cloud SMS while keeping backend infrastructure. The findings echo earlier reporting on **Triada**, an Android malware family that evolved from a rooting trojan into a preinstalled system-image backdoor embedded in framework components. Google previously said Triada abused privileged contexts such as **System UI** and **Google Play** to execute code, monitor foreground apps, replace ads, and install applications so they appeared to come from Google Play, and that infections were inserted into device images during production by a third party using the names **Yehuo** or **Blazefire**. Trend Micro said the newer Guerrilla campaign showed infrastructure overlap with Triada operators, suggesting a continuing ecosystem of firmware-level Android compromise monetized through fraud, silent installs, and persistent device backdoors.
Aug 21, 2026
Sophos reported that some Android devices were delivered to users with malware already embedded at the firmware level, indicating compromise somewhere in the device supply chain rather than through a typical post-sale infection. Because the malicious code resides below the application layer, it can survive resets, evade standard mobile security controls, and give attackers persistent access to the device. The finding raises concerns for enterprises that rely on Android endpoints for corporate access, especially where bring-your-own-device and low-cost handset procurement are common. Preinstalled firmware malware can expose credentials, communications, and managed applications from the moment a device is activated, making hardware sourcing, mobile threat defense, and strict device attestation critical parts of enterprise mobile security programs.
Jul 12, 2026