Experts uncover malware campaign tied to Triada Trojan

GBHackers News reports that Adex analysts have identified and counteracted a Triada Trojan-linked malware operation that has targeted the mobile advertising ecosystem. According to industry data, the trojan accounted for 15.78% of all detected malware infections in Android devices in the third quarter of this year. Analysts from Adex found that threat actors behind Triada have tried to enter legitimate advertising networks over the past five years.

Hackers have used cloaked redirects to distribute malicious APK files in compromised advertiser accounts and reputable platforms, which makes it difficult for standard security protocols to detect. Analysts have also identified three activity patterns that show the increasing adaptation of modern fraud techniques. The first one is the use of low-quality forged identity documents to bypass Know Your Customer (KYC) protocols between 2020 and 2021.

Attackers leveraged Discord Content Delivery Networks and URL shorteners to distribute malware. The second pattern showed a shift to direct account takeovers from 2022 to 2024. Advertiser accounts that had no two-factor authentication (2FA) were targeted. By 2025, the use of phishing pre-landers that mimicked urgent Chrome browser updates emerged as the third pattern.

This activity correlated with suspicious login patterns that originated from India and Turkey, according to data from VirusTotal. Adex developed a comprehensive business-protection strategy in response to these findings. This commands stricter KYC procedures and imposes login anomaly monitoring and 2FA for all advertiser accounts.