An update infected my Android phone with Triada malware. Google ignored me
Comments on “An update infected my Android phone with Triada malware. Google ignored me”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
A developer's blog post reports that a September 2026 security update on a budget Maxwest Nitro A65 Android phone, sold through the US Lifeline subsidy program, installed Triada trojan malware with system-level privileges.
Why it ranked
No. 25 of 124 with a score of 0.67. The panel rated it highest on new information (0.92) and substantiated (0.88), lowest on audience breadth (0.57).
Every answer behind this is in the table under Score.
Score
0.67total under rubric v2.2
- Significance0.65
- Reader interest0.80
- Audience breadth0.57
- Practical relevance0.66
- Substantiated0.88
- Technical depth0.86
- New information0.92
- Counts against: Promotional0.04
- Counts against: Overclaim0.38
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.57 | 0.60 | 0.78 | 0.65 | 0.21 | +0.24 | +0.156 |
| Reader interest | 0.63 | 0.85 | 0.92 | 0.80 | 0.29 | +0.26 | +0.208 |
| Audience breadth | 0.57 | 0.60 | 0.55 | 0.57 | 0.05 | +0.13 | +0.075 |
| Practical relevance | 0.65 | 0.60 | 0.72 | 0.66 | 0.12 | +0.22 | +0.145 |
| Substantiated | 0.97 | 0.85 | 0.82 | 0.88 | 0.15 | +0.05 | +0.044 |
| Technical depth | 0.99 | 0.80 | 0.78 | 0.86 | 0.21 | +0.05 | +0.043 |
| New information | 0.90 | 0.90 | 0.97 | 0.92 | 0.07 | +0.05 | +0.046 |
| Promotional | 0.05 | 0.03 | 0.03 | 0.04 | 0.02 | −0.19 | −0.007 |
| Overclaim | 0.52 | 0.20 | 0.42 | 0.38 | 0.32 | −0.11 | −0.042 |
| Sum of contributions | +0.667 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.667 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-27/25/"><img src="https://rubric.hrih.si/badge/2026-10-27/25.svg" alt="Ranked #25 on Rubric, 27 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 2 matches source · 6 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
Maxwest Telecom is one of over 3,800 brands of Google certified Android devices.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “they are one of over 3,800 brands of Google certified Android devices”
The source says No passage could be compared.
Source cited by the article: manojitballav.com/google-certified-devices.html
Couldn’t checkGeneralization
The Maxwest Nitro A65 is sold at a deep discount by Gen Mobile, a carrier providing Lifeline government-subsidized phone service.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The Maxwest Nitro A65 is sold at a deep discount by Gen Mobile, a phone carrier which provides Lifeline government-subsidized phone service”
The source says No passage could be compared.
Source cited by the article: genmobile.com/products/maxwest-nitro-a65
Matches sourceNumber
Triada's cryptocurrency-stealing operations had made its operators at least $264,000 as of April 2025, according to Kaspersky researchers.
The cited source says the same thing.
The article says “a venture which had made the operators at least $264,000 as of April 2025, according to Kaspersky researchers”
The source says “The criminals have managed to steal more than US$264 000 in various cryptocurrencies since June 13, 2024 with the help of these tools”
Source cited by the article: kaspersky.com/blog/trojan-in-fake-smartphones/53331
Couldn’t checkGeneralization
Google and Kaspersky have reported that preinstalled Triada variants are embedded in the core system library libandroid_runtime.so.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The preinstalled variants of Triada have been reported by Google and Kaspersky to be embedded into a core system library, libandroid_runtime.so”
The source says No passage could be compared.
Source cited by the article: kaspersky.com/blog/trojan-in-fake-smartphones/53331
Couldn’t checkDate
The string "os.config.ppgl.status" has been associated with Triada since at least 2017.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “which has been associated with Triada since at least 2017”
The source says No passage could be compared.
Source cited by the article: vms.drweb.ru/virus
Couldn’t checkDate
On October 7, 2026, Bitdefender published an article describing a preinstalled Android malware strain it named "Midnight Mimosa", and the Nitro A65 is on its graph of most common infected devices.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “On October 7, 2026, after I had already reported this issue to Google, an interesting twist emerged in this story”
The source says No passage could be compared.
Source cited by the article: bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
Matches sourceQuote
Google's Play Protect certification materials say certified devices are required to ship without pre-installed malware.
The cited source says the same thing.
The article says “Play Protect certified devices are also required to ship without pre-installed malware and include Google Play Protect”
The source says “Play Protect certified devices are also required to ship without pre-installed malware and include Google Play Protect, a suite of security features such as automatic virus scanning and Find My…”
Source cited by the article: android.com/certified
Couldn’t checkGeneralization
The Nitro A65 still passes Google Play Integrity checks and appears on Google's list of certified Android devices.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “it still passes Google Play Integrity checks and appears on Google's list of certified Android devices”
The source says No passage could be compared.
Source cited by the article: storage.googleapis.com/play_public/supported_devices.html
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 3 pts, not on front page
Recorded for context only, checked 27 Oct 2026, 05:46 UTC. It played no part in the ranking.