I'm working on analyzing a similar compromise of Google-certified phones and tablets, some actively sold, with Triada and other malware, but have not yet been successful at reporting it to Google. If you know anyone who can get this to Google's threat intelligence team, send them the link to my report: https://ethannelson-moore.github.io/blog/2026/10/25/maxwest-...
I'm increasingly sure that most residential proxies are... involuntary residential proxies.
From a very cursory look at the Google breakdown, it looks as if devices connect out on port 8000 to a specific domain. In my increasingly paranoid setup of my firewall, I'm leaning towards blocking all outbound ports other than the very small number that facilitate regular browsing. I'm almost surprised that malware would use a non-standard port since it makes it easier to identify as outlier traffic.
From a very cursory look at the Google breakdown, it looks as if devices connect out on port 8000 to a specific domain. In my increasingly paranoid setup of my firewall, I'm leaning towards blocking all outbound ports other than the very small number that facilitate regular browsing. I'm almost surprised that malware would use a non-standard port since it makes it easier to identify as outlier traffic.