If you are thinking about buying a used Android phone, think twice. They may come pre-loaded with malware such as Triada.
Counterfeit versions of popular smartphone models that are sold at reduced prices have been found to be preloaded with a modified version of an Android malware called Triada.
“More than 2,600 users in different countries have encountered the new version of Triada, the majority in Russia,” Kaspersky said in a report. The infections were recorded between March 13 and 27, 2025.
Triada is the name given to a modular Android malware family that was first discovered by the Russian cybersecurity company in March 2016. A remote access trojan (RAT), it’s equipped to steal a wide range of sensitive information, as well as enlist infected devices into a botnet for other malicious activities.
While the malware was previously observed being distributed via intermediate apps published on the Google Play Store (and elsewhere) that gained root access to the compromised phones, subsequent campaigns have leveraged WhatsApp mods like FMWhatsApp and YoWhatsApp as a propagation vector.
Although most of these phones were bought in Russia, any secondhand phone around the world could contain malware. Even if you are planning on wiping the device and installing a custom ROM like Graphene OS, there is no guarantee that the phone model itself is counterfeit.
I wonder if there a preferred and trusted method of obtaining a used Google Pixel, such as through an authorized reseller.