New android malware “Tria Stealer” hijacks messaging apps, steals banking info – ngCERT issues high-alert warning

The Nigeria Computer Emergency Response Team (ngCERT) has issued an urgent high-alert warning over a rapidly spreading, sophisticated malware campaign targeting Android devices.

Dubbed Tria Stealer, the cyber threat is exploiting unsuspecting users through fake event invitations delivered via popular messaging platforms like WhatsApp and Telegram.

According to ngCERT, Tria Stealer is a highly evasive piece of malicious software capable of hijacking WhatsApp and Telegram accounts, intercepting One-Time Passwords (OTPs), stealing personal and banking credentials, and facilitating identity theft. It also gives attackers unauthorized access to sensitive functions on victims’ smartphones.

The malware is being disseminated through fraudulent Android Package Kit (APK) files disguised as wedding or event invitations. Victims receive these infected APKs through chat messages and, believing them to be legitimate, proceed to install the apps.

READ ALSO: Kaspersky uncovers malware targeting 45 countries, 1,700 Banks

Once installed, the malware disguises itself as a legitimate system application, gaining critical permissions to access SMS, call logs, and app notifications. It begins exfiltrating data immediately, which is then relayed to a Command and Control (C2) server operated via Telegram bots.

NgCERT warned that both private users and corporate organizations are at significant risk. The malware’s ability to impersonate trusted contacts makes even tech-savvy users vulnerable to exploitation.

Those who frequently use mobile messaging for business or financial communications are particularly at risk.

NgCERT emphasized the evolving sophistication of cybercriminals targeting mobile platforms and reiterated the importance of vigilance, digital hygiene, and layered security defenses.

For updates and incident reports, users are advised to visit the official ngCERT website or contact their helpdesk.