Triada malware infected 2,600+ Android devices via counterfeit phones in March 2025, enabling remote access and crypto theft.