US Edition
Android Backdoor Pre-Installed On Devices — Thousands Already Infected
- Kaspersky researchers discovered Keenadu, an Android backdoor embedded in firmware of devices from multiple makers, giving attackers unlimited control over infected devices as of February 2026.
- Kaspersky says the malware spreads via compromised firmware OTAs, other backdoors, embedded system apps, modified APKs and Google Play; Alldocube acknowledged an OTA server compromise and a malicious August 18, 2023 firmware on the iPlay 50 mini Pro.
- In its firmware-integrated variant, Keenadu compromises the libandroid_runtime.so core library to operate within every app, silently installs apps, monitors Chrome browser incognito searches, and resists standard Android OS removal tools.
- Some Google Play apps reached 300,000 downloads before removal, with 13,000 infected devices confirmed by Kaspersky , and researchers advise finding clean firmware or replacing devices while warning of broad data theft risks.
- Embedding in system apps for facial recognition increases stealth, but malware stops if Google Play Store and Play Services are absent, while researchers compare Keenadu to Triada across multiple device makers and low-cost supply chains.
16 Articles
16 Articles
New Keenadu backdoor found in Android firmware, Google Play apps
A newly discovered and sophisticated Android malware called Keenadu has been found embedded in firmware from multiple device brands, enabling it to compromise all installed applications and gain unrestricted control over infected devices.
They warn about Keenadu, the ‘malware’ preinstalled on some new Android devices for advertising fraud
Cybersecurity experts have warned about Bring ita new ‘malware’ identified on Android devices, Spain being one of the countries with the highest number of detections, which can come pre-installed directly in the ‘firmware’ of the device, be integrated into system applications or downloaded from official stores such as Google Play. Malicious actors use this ‘malware’ […]
Multiple brands of Android tablets shipped with built-in malware (Updated: Google statement)
TL;DR Researchers found a firmware-level Android backdoor called Keenadu preinstalled on certain tablets before sale. The malware injects into Android’s Zygote process, giving attackers broad control over apps and data on the tablets. Google says that Android users are automatically protected from known versions of this malware by Google Play Protect. Update, February 17, 2026 (02:35 PM ET): After the publication of the original article below, …
A new Android malware called Keenadu nests directly in the tablet firmware. Unnoticed, attackers take control, even in the Google Play Store the malicious code appeared. The removal is almost impossible for laymen. (Continue reading)
Coverage Details
Bias Distribution
- 67% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
