Android Phones Pre-Downloaded With Malware Target User Crypto Wallets

Research from Doctor Web and other vendors found cheap, counterfeit or imitation Android phones preloaded with Trojanized WhatsApp/Telegram apps (using an LSPatch injector called Shibai) and other malware (e.g., Triada) that steal cryptocurrency via clipboard address replacement, harvest messages and files, and exfiltrate device data; the campaign leverages supply-chain compromise, operates dozens of C2 servers and domains, and has funneled significant sums into attacker-controlled wallets.