{
	"id": "ef96679d-784f-497e-a75e-846a53b618e1",
	"created_at": "2026-04-06T00:06:44.411183Z",
	"updated_at": "2026-04-10T03:21:26.436672Z",
	"deleted_at": null,
	"sha1_hash": "4fb9049ee59a0e24b9075ea0ba7095aaf6eb5f97",
	"title": "Everyone sees not what they want to see",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 514760,
	"plain_text": "Everyone sees not what they want to see\r\nBy Anton Kivva\r\nPublished: 2016-06-06 · Archived: 2026-04-05 20:01:08 UTC\r\nIn early March, Kaspersky Lab detected the modular Trojan Backdoor.AndroidOS.Triada which granted superuser\r\nprivileges to downloaded Trojans (i.e. the payload), as well as the chance to get embedded into system processes.\r\nSoon after that, on March 15, we found one of the modules enabling a dangerous attack – spoofing URLs loaded\r\nin the browser.\r\nThe malicious module consists of several parts and is detected by Kaspersky Lab products as\r\nBackdoor.AndroidOS.Triada.p/o/q. When it gains superuser privileges, it uses regular Linux debugging tools to\r\nembed its DLL (Triada.q, which then loads Triada.o) into the processes of the following browsers:\r\ncom.android.browser (the standard Android browser)\r\ncom.qihoo.browser (360 Secure Browser)\r\ncom.ijinshan.browser_fast (Cheetah browser)\r\ncom.oupeng.browser (Oupeng browser)\r\nThe DLL intercepts the URL the user is opening, analyzes it and, if necessary, changes it to another URL. The\r\nrules for changing the URL are downloaded from the C\u0026C server while the module is running.\r\nAttack sequence\r\nIn an uninfected system, the browser sends a request with a URL address to the web server via the Internet, and\r\nreceives a page in response.\r\nAfter infection by Triada, a DLL intercepting URLs is added to the browser’s process. The URL address request\r\nfinds its way into this DLL, where it is modified and sent to another web server.\r\nhttps://securelist.com/everyone-sees-not-what-they-want-to-see/74997/\r\nPage 1 of 3\n\nAs a result, the browser receives data that’s different from that requested, meaning the user ends up viewing a\r\ndifferent page.\r\nNow, this sequence of actions is being used by malware creators to change the standard search engine selected in\r\nthe user’s browser, and to replace the home page. Essentially, these actions are identical to those carried out by\r\nnumerous adware programs for Windows. However, there is nothing to stop similar attacks intercepting any URL,\r\nincluding banking URLs, and redirecting users to phishing pages, etc. All it takes is for the cybercriminals to send\r\nthe appropriate command.\r\nDuring our observation period, this module attacked 247 users, and there have been no signs of a decrease in the\r\nintensity of attacks. The number of module versions is small; it appears the creators of this backdoor have decided\r\nto focus their efforts elsewhere, in spite of all the ‘promise’ shown by this technology.\r\nThe geography distribution is very similar to that of root-access malware, as this module can only function\r\ntogether with Triada, and is downloaded by Triada.\r\nhttps://securelist.com/everyone-sees-not-what-they-want-to-see/74997/\r\nPage 2 of 3\n\nNumber of users attacked by Backdoor.AndroidOS.Triada.p in different countries\r\nIn conclusion, we would like to note that cybercriminals specializing in Android are pretty lazy – it’s easier for\r\nthem to steal money directly, for instance, with the help of Trojans that send text messages to premium-rate\r\nnumbers, or spoof banking app windows. However, we have recently observed that some cybercriminals have\r\nbegun to actively study the structure of the operating system, expand their repertoire of technical skills, and launch\r\nsophisticated attacks like the one we examined above.\r\nSource: https://securelist.com/everyone-sees-not-what-they-want-to-see/74997/\r\nhttps://securelist.com/everyone-sees-not-what-they-want-to-see/74997/\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia",
		"MITRE"
	],
	"references": [
		"https://securelist.com/everyone-sees-not-what-they-want-to-see/74997/"
	],
	"report_names": [
		"74997"
	],
	"threat_actors": [],
	"ts_created_at": 1775434004,
	"ts_updated_at": 1775791286,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/4fb9049ee59a0e24b9075ea0ba7095aaf6eb5f97.pdf",
		"text": "https://archive.orkl.eu/4fb9049ee59a0e24b9075ea0ba7095aaf6eb5f97.txt",
		"img": "https://archive.orkl.eu/4fb9049ee59a0e24b9075ea0ba7095aaf6eb5f97.jpg"
	}
}