Tracing the Supply Chain Attack on Android
Summary: Google disclosed that a supply chain attack by one of its vendors pre-installed malicious software on millions of new budget Android devices, and it named the vendor only by the nicknames "Yehuo" and "Blazefire." Krebs traced those names to Shanghai Blazefire Network Technology Co. Ltd., whose registrant email tosaka1027@gmail.com was used to register 24 domains, at least seven tied to Android malware including Triada and the Hummer Trojan.
Why it matters: Dr.Web found Triada pre-installed by default on at least four low-cost Android models in 2017 and on 40 models in 2018, so the malware reached users before they installed anything themselves. The vendor's own 2016 job ad for client software development sought experience with "Windows Trojan, Virus or Game Plug-ins" and listed cracking manufacturer restrictions on the phone among the role's responsibilities.
Read the original at Krebs on Security ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026