Triada: the Android trojan that survives a factory reset
Most advice about a compromised Android phone ends the same way: back up your data and reset the device. For most malware that works. For Triada it often does not, and understanding why explains a lot about the limits of consumer security tools.
Scan my deviceWhat makes Triada different
Triada was first documented by Kaspersky researchers in 2016 and has kept resurfacing in new variants since. What set it apart from the start was not its payload but where it operates. Android launches every application from a single parent process called Zygote. Every app your phone runs is forked from it. Triada injects itself into Zygote, which means it sits upstream of every application on the device and can alter the behaviour of any of them — including the banking app, the messaging app and the browser. It is also modular. The core component is small and its job is mainly to fetch additional modules from a command-and-control server. What a given infection actually does depends on which modules were delivered, which is why reports on Triada describe such varied behaviour over the years.
Why a factory reset often fails
Triada has repeatedly been found preinstalled in the firmware of low-cost and counterfeit Android devices, delivered through compromised points in the manufacturing and distribution chain rather than through anything the owner did. When the malicious component lives in the system partition, it is not part of the user data a factory reset erases. The reset restores the device to its shipped state, and the shipped state is the infected one. The device comes back clean of your data and still compromised. This is the practical consequence: on a device where Triada is present at firmware level, no consumer application can remove it, including this one. Detection tells you the device is compromised. Remediation means replacing the device or reflashing it with verified firmware, which is not a routine operation.
What it does in a banking context
Reported Triada capabilities relevant to financial fraud include intercepting SMS messages, which covers one-time verification codes; hiding its own presence from the installed application list; downloading and installing further components without user interaction; and substituting cryptocurrency wallet addresses so that a transfer copied to the clipboard arrives somewhere else. Because Triada operates from Zygote rather than as a separate app requesting permissions, none of this depends on you granting anything. There is no accessibility prompt to notice and decline.
What is visible on the network
A file scanner has a structural problem with Triada: there may be nothing in user storage to scan, and the trojan can hide itself from the application list it would be enumerated in. What it cannot hide is the conversation with its infrastructure. The modular design makes this worse for the attacker, not better — a core component that fetches modules has to reach out repeatedly. The indicators our engine tracks for this family include several pseudo-random subdomains rotating under a small number of registered parent domains, a pattern consistent with algorithmically generated hostnames; command-and-control endpoints hosted on large commercial cloud infrastructure, where the hosting provider itself is unremarkable and only the specific endpoints are not; and periodic check-in intervals characteristic of a component waiting for module delivery. We do not publish the indicator values themselves. Publishing them tells the operators which of their infrastructure is burned.
How SmartScan approaches it
The scan captures your device's network traffic through an encrypted tunnel and processes it against the full engine stack. The engines that carry most of the weight for this family are temporal analysis and beacon detection for the periodic check-in pattern, the DNS failover tracker for rotating hostname behaviour, geolocation and ASN risk scoring for the endpoints, and on Android per-flow UID attribution, which can indicate which package owned a given connection. Every alert in the report is mapped to a documented MITRE ATT&CK for Mobile technique, with timestamps and the evidence attached. Being precise about scope: the analysis observes command-and-control communication and data exfiltration. It does not intercept the moment a credential is captured, because on a Zygote-level implant that happens locally, with no network event to observe.
If a scan flags this family
Do not reset the device first. On a firmware-level infection the reset will not help, and on any infection it destroys the evidence that the compromise existed. Keep the report. If the device is a low-cost or grey-market Android, or was bought second hand, the report is also what supports a claim against the seller. If money moved, it is what supports the dispute with your bank and the police report. The report is built to support forensic analysis; admissibility is decided by the court.