Triada Malware Preloaded on Counterfeit Android Phones Infects 2,600+ Devices

I haven’t checked how Graphene does it but I doubt attestations go through on counterfiets? Previous discussion: Refurbished - #42 by ignoramous

There indeed is: https://store.google.com/magazine/refurbished_devices?hl=en-US

Using AccessibilityService / Camera / Microphone / Notifications / MediaProjection / VPN / InputMethod (keyboard) / Digital Well-being APIs to spy on endusers is a tale as old as Android Astro Boy. In countries like India & Egypt, folks purchase such phones as gifts to spy on their partners / wives / children.