The most dangerous Android malware you should know about

The scale of the problem

According to Kaspersky Securelist's annual mobile threat report, more than 14 million attacks involving malware, adware, or unwanted mobile software were blocked throughout 2025 — an average of 1.17 million per month. Of those, over 815,000 malicious installation packages were detected, including 255,000 mobile banking Trojans¹.

This isn't a theoretical problem exaggerated to sell something: it's real detection data from one of the largest cybersecurity companies in the world, published in March 2026.

Triada: the one that installs before you even buy the device

Triada is a modular Android remote access trojan (RAT), originally discovered by Kaspersky in March 2016. It saw a major resurgence in 2025: according to The Hacker News, it was found preinstalled on counterfeit smartphone models sold at reduced prices². Kaspersky put it this way: "Triada infects device system images through a third-party during the production process" — meaning it compromises the supply chain at the factory, the exact same pattern BADBOX 2.0 uses on TV boxes.

Between March 13 and 27, 2025 alone, more than 2,600 users encountered the new version; by late April there were already more than 4,500 infections detected worldwide, with the highest concentration in Russia, followed by the UK, the Netherlands, Germany, Brazil, and the UAE^2,3. Once installed, Triada can steal Telegram, TikTok, and Instagram accounts, intercept and send WhatsApp messages, hijack cryptocurrency wallet addresses, monitor browsing, swap phone numbers during calls, intercept SMS, and subscribe the victim to paid services.

Joker: the classic Google keeps purging from the Play Store

Joker (internally called "Bread" by Google) is spyware combined with a premium dialer: it hides inside apps that look legitimate and, once installed, accesses notifications, reads and sends SMS, and subscribes the victim to premium-rate services without consent — on top of harvesting contact lists.

What's notable about Joker isn't a single incident, but its year-after-year persistence:

• In January 2020, Google Play Protect removed 1,700 unique apps from the "Bread" family.
• In September 2020, 17 new samples were identified, with around 120,000 downloads.
• Google purged another 24 infected apps, which had been downloaded by at least 472,000 users, for signing people up for premium SMS services and stealing contacts and messages.
• In 2022, a variant ("SpyJoker") appeared with over 3 million installs before being removed.

It's a good reminder that "it's on Google Play" isn't an absolute guarantee: Google actively detects and removes these apps, but the malware keeps reappearing under new identities⁴.

Banking trojans: Vultur and the Mamont family

Banking trojans were the fastest-growing category of Android malware in 2025. According to Kaspersky, the Mamont family accounted for roughly half (49.8%) of all banking trojan installation packages detected for the full year¹. Alongside Mamont, 2025 saw several new families emerge: Vultur, DroidBot, Errorfather, and BlankBot.

Vultur in particular was first identified in 2021 as a relatively simple banking trojan, but by 2024 it had evolved into a much more sophisticated threat with greater control over the infected device⁵ — a typical pattern for this kind of malware: it doesn't go away, it professionalizes.

One more data point from the same Kaspersky report is especially relevant here: they identified "Keenadu," a preinstalled backdoor injected during device manufacturing directly into core Android libraries — another example that factory-preinstalled malware isn't an isolated case limited to TV boxes, but a growing trend across the entire Android ecosystem¹.

What they all have in common

None of the examples on this list get caught by a traditional antivirus that only scans the apps you installed. Triada and "Keenadu" live in the firmware or system libraries from before the very first boot. Joker and the banking trojans disguise themselves as legitimate apps until Google (or someone) detects and removes them — but by then, they've already infected hundreds of thousands of users.

If your device is a generic TV box, without a recognized brand or Google certification, the risk of having something like this preinstalled is real and documented, not hypothetical.