Triada strikes back

Executive summary: Kaspersky researchers describe an evolved Triada Trojan persistently embedded in Android device firmware (pre-sale counterfeit/compromised devices) that infects the Zygote process and injects modular payloads into every app. Modules enable cryptocurrency address replacement/clipboard hijacking, credential and cookie theft from messaging/social apps and browsers, SMS interception and premium-SMS abuse, link substitution in browsers, reverse-proxying of network traffic, and remote payload delivery; the report includes technical analysis, IOCs (hashes, domains, IPs, GitHub configs), and telemetry showing thousands of detections.