Loading malware…
Triada is a sophisticated modular Android malware family best known as a firmware-level backdoor and Trojan platform. First documented in the mid-2010s, it evolved from a root-enabled modular Trojan into a supply-chain threat embedded in system images and counterfeit or low-cost Android device firmware before sale. Its architecture emphasizes stealth, persistence, and extensibility: Triada has been observed modifying core Android components, embedding code into system libraries and processes, and leveraging Zygote-based injection so malicious code executes inside many or nearly all app processes on an infected device. This design allows it to inherit app permissions, access sensitive data, and conceal its presence by interfering with process, package, and service visibility.
Triada has been associated with multiple infection vectors. Historically it was delivered by rooting malware and downloader chains that obtained superuser privileges and wrote components into the system partition. It has also been found preinstalled during device manufacturing or firmware customization by third parties in the supply chain, making removal extremely difficult for end users. In addition, Triada components have appeared in trojanized Android applications and unofficial app modifications, including altered messaging clients and third-party app stores, where embedded code registers the device, downloads encrypted payloads, and launches additional malware.
The family functions as a malware platform that downloads and executes modules in memory or from staged payloads. Observed capabilities include command-and-control communications over standard web protocols, device profiling, application discovery, interception of foreground-app information, silent downloading and installation of attacker-chosen applications, ad fraud, browser traffic manipulation, SMS interception and modification, premium-subscription fraud, and broad post-compromise backdoor activity. Triada has been documented abusing privileged access to hook Android framework methods, replace binder services related to SMS handling, and alter browser behavior through injected modules. One notable capability is interception and rewriting of SMS-based payment or confirmation flows, enabling transaction redirection, OTP capture, and subscription fraud. Other observed modules have supported WhatsApp account abuse, cryptocurrency theft through wallet-address replacement, reverse-proxy functionality, and theft of tokens, cookies, credentials, or session material from targeted apps.
Triada has also been used as a delivery vehicle for other malware families and helper components, including downloaders, ad-fraud modules, subscription Trojans, and persistent installers. In some campaigns it abused Google Play processes or system privileges to install secondary payloads without meaningful user interaction. Its modular ecosystem has shown overlap with preinstalled Android fraud operations such as BADBOX and PEACHPIT, where Triada-like firmware backdoors enabled ad fraud, residential proxying, fake account creation, OTP interception, and remote code installation on Android phones, tablets, TV boxes, and smart TVs.
The malware primarily targets Android and is especially dangerous when embedded in firmware or system partitions, because ordinary app-level removal is ineffective. Triada is widely regarded as one of the most technically advanced Android malware families due to its deep system integration, persistence mechanisms, process-wide injection model, and long-running use in both cybercrime monetization and supply-chain compromise.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...redirect unsuspecting site users to ... malware, including an Android malware called Triada in one case."
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Finally, because of the backdoor’s connection to C2 servers on BADBOX-infected smartphones, tablets, and CTV boxes, new apps or code can be remotely installed by the threat actors without the device owner’s permission.
The backdoor also injected code that allowed it to use the Google Play app to download and install apps of the attackers’ choice.
Users of smartphones who do not receive security updates are less fortunate: in outdated versions of the OS, the malware is capable of not only loading additional apps, but installing them on the system partition.
Once the app is launched, the malware gathers unique device identifiers...
If classes.dex is deleted from memory, it’s immediately restored, underscoring the persistence of the threat.
The T95 device examined by the Satori team, upon booting up, immediately injected the com.jar library into process memory... The classes.dex file created by the decryption of classes.png is injected into the above launcher process.
the DEX files are downloaded and saved. Then these files are downloaded in the context of the malicious program using DexClassLoader.loadClass()
classes.png, the filename of which suggests an image file, is actually an encrypted file that, when decrypted, turns into classes.dex.
The T95 device examined by the Satori team, upon booting up, immediately injected the com.jar library into process memory... The classes.dex file created by the decryption of classes.png is injected into the above launcher process.
If these files were updated earlier than the last response was received, the Trojan deletes these files
After that, the modules are removed from the disk, i.e. they only remain in device memory
When the app starts, the payload is decrypted and launched. In this case, it is located in a long string in the app code.
If classes.dex is deleted from memory, it’s immediately restored, underscoring the persistence of the threat.
At some point between the manufacturing of these products and their delivery to resellers... a firmware backdoor—based on Triada malware—gets installed.
The Trojan substitutes the function to hide its modules from this list... running services... running applications... installed packages
the Trojan substitutes standard methods from Android Framework with methods implemented in libconfigpppl.so
115 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
51 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android malware family appearing prominently in Q2 2026 detection rankings, represented by multiple backdoor and trojan variants among the most frequently detected mobile threats.
Android malware family appearing in multiple backdoor and trojan variants and prominently represented in the quarter's top mobile malware detections.
Android malware family appearing in both backdoor and trojan detections, with multiple variants among the most frequently detected mobile malware in the quarter.
Android malware/trojan referenced as being preinstalled on smartphones out of the box.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.