Cheap Android smartphones manufactured by Chinese companies have been found pre-installed with trojanized applications masquerading as WhatsApp and Telegram, containing cryptocurrency clipper functionality. This campaign, active since June 2024, marks a significant escalation in malware use, directly targeting the supply chain to preload devices with malicious applications. Researchers discovered that fraudulent applications were embedded in the software pre-installed on these phones. The compromised devices are primarily low-end models mimicking premium brands like Samsung and Huawei, with names such as S23 Ultra and P70 Ultra, manufactured under the SHOWJI brand. Attackers used applications to falsify technical specifications displayed on the About Device page, deceiving users into believing the phones run Android 14 with enhanced hardware. The trojan, dubbed Shibai, is created using LSPatch, an open-source project that injects malicious code into legitimate software. Approximately forty (40) applications, including messengers and QR code scanners, were modified in this manner. Researchers’ analysis revealed that the malware hijacks the application update process to download APK files from an attacker-controlled server, replacing cryptocurrency wallet addresses in conversations with the adversary’s addresses to reroute transactions. The malware displays correct wallet addresses to the sender while altering them for the recipient, facilitating unauthorized access and asset drainage. In addition to wallet address manipulation, the malware extracts device information, WhatsApp messages, and images from various folders, scanning them for wallet recovery phrases. Despite the anonymity of the campaign’s organizers, they utilize thirty (30) domains for app distribution and over sixty (60) command-and-control (C2) servers. The attackers have amassed more than $1.6 million over two (2) years, highlighting the effectiveness of this supply chain compromise.