A new version of the Triada trojan has been discovered preinstalled on thousands of new Android devices, allowing threat actors to steal data as soon as they are set up.

Kaspersky researchers report that this campaign mainly impacts Russian users, with at least 2,600 confirmed infections from March 13 to 27, 2025, based on visibility from its mobile protection tools.

The security researchers noted that Triada was found on counterfeit versions of popular smartphone models sold at online stores at discounted prices to attract interests of unexpecting buyers.