Security firm: Hackers are selling fake Android phones with pre-installed cryptocurrency to steal malicious software

Cyber security company Kaspersky said it had found thousands of counterfeit Android smartphones sold online pre-installed malicious software designed to steal cryptocurrencies and other sensitive data. The low-priced Android devices were filled with a variant of the Triada Trojan horse virus, which infects all processes, giving attackers "almost complete control" over the device. Once the Trojan horse accesses the device, the attacker can change the wallet address to steal cryptocurrency. In addition, the virus can steal user account info and intercept sending and receiving text messages, including two-factor authentication text messages. So far, there have been 2,600 confirmed infections related to the scam in different countries, with most Russian users "caught" in the first three months of 2025. To avoid falling victim to such scams, it is best practice to purchase devices only from legitimate dealers and install security solutions immediately after purchase.