Article last updated: June 2026

While is Huawei's proprietary operating system, many of its older devices, as well as its strategic approach to the global market, still involve Android applications. The Android version of the MoqHao/XLoader malware is fully capable of running on and stealing data from Huawei devices running Android. Consequently, any Huawei phone user is a potential target of this malware.

Huawei XLoader is a stealthy Android Trojan distributed primarily through SMS phishing campaigns (Smishing). Attackers send deceptive text messages disguised as package delivery notifications, official bank alerts, or critical security updates.

in the context of Huawei typically refers to a critical primary bootloader component in Huawei’s Kirin chipsets. It is responsible for the earliest stages of the boot process and security verification before handing off to the main fastboot/bootloader. The Technical Role of Huawei Xloader

To prevent security researchers and automated network firewalls from blocking its Command and Control servers, XLoader employs a clever trick. Instead of hardcoding C2 IP addresses into the malware binary, it extracts configuration data from public social media profiles, specifically .

In the shifting landscape of cybersecurity, the lines between consumer electronics and national security have never been blurrier. For years, Huawei has stood as a titan of telecommunications—a symbol of Chinese technological ascendancy. Meanwhile, XLoader (the evolutionary successor to the infamous KeyBase Trojan) has operated as one of the most persistent, cross-platform "Malware-as-a-Service" (MaaS) threats in the wild.

In the ever-evolving landscape of cybersecurity, malware families continuously adapt and refine their techniques to evade detection and maximize impact. Among the most persistent and sophisticated threats is —a formidable information stealer and botnet loader that has been active since at least 2015. Developed from the infamous Formbook malware, XLoader has matured into a cross-platform threat capable of targeting Windows, macOS, and Android operating systems. Its evolution reflects a broader trend in cybercrime: the professionalization of malware development through Malware-as-a-Service (MaaS) models, advanced evasion techniques, and the adoption of generative AI to enhance both offense and defense.

Modern Huawei devices utilize a Trusted Execution Environment (TEE) backed by hardware cryptographic keys to secure user data. Exploiting the boot sequence at the Xloader stage can allow unauthorized access to the TEE memory space, potentially putting encrypted user data and cryptographic keys at risk. 4. Device Bricking Risks

While engineers use custom xloaders for device recovery, the word "XLoader" is heavily associated with a notorious family of mobile trojans and spyware. Active across various iterations, this malware family—operated by the financial threat group Roaming Mantis —poses a major threat to Android users worldwide. How the Malware Targets Mobile Devices

Read text and data directly off the screen (screen scraping).

It is important to distinguish the legitimate Kirin boot component from a notorious strain of also named Xloader (sometimes called MoqHao).

It reads all incoming and outgoing messages. This allows attackers to intercept two-factor authentication (2FA) codes sent by banks and email providers.

Are you trying to using an exploit, or are you concerned about a malware detection on your device?