US EditionAndroid Backdoor Pre-Installed On Devices — Thousands Already Infected
- Kaspersky researchers discovered Keenadu, an Android backdoor embedded in firmware of devices from multiple makers, giving attackers unlimited control over infected devices as of February 2026.
- Kaspersky says the malware spreads via compromised firmware OTAs, other backdoors, embedded system apps, modified APKs and Google Play; Alldocube acknowledged an OTA server compromise and a malicious August 18, 2023 firmware on the iPlay 50 mini Pro.
- In its firmware-integrated variant, Keenadu compromises the libandroid_runtime.so core library to operate within every app, silently installs apps, monitors Chrome browser incognito searches, and resists standard Android OS removal tools.
- Some Google Play apps reached 300,000 downloads before removal, with 13,000 infected devices confirmed by Kaspersky , and researchers advise finding clean firmware or replacing devices while warning of broad data theft risks.
- Embedding in system apps for facial recognition increases stealth, but malware stops if Google Play Store and Play Services are absent, while researchers compare Keenadu to Triada across multiple device makers and low-cost supply chains.
20 Articles
20 Articles
New Keenadu backdoor found in Android firmware, Google Play apps
A newly discovered and sophisticated Android malware called Keenadu has been found embedded in firmware from multiple device brands, enabling it to compromise all installed applications and gain unrestricted control over infected devices.
On thousands of Android devices there is a malicious software that allows hackers to read personal data. This is how you protect yourself. This article has been sorted under Current Fraud Warnings.
Kaspersky researchers have discovered a rare but dangerous Android malware that can be installed on devices at the moment of purchase. This is not the first such virus.
New backdoor found in Android tablets targeting users in Russia, Germany and Japan
In a report released this week, Russian cybersecurity firm Kaspersky said it uncovered a previously undocumented backdoor dubbed Keenadu that is built directly into a device’s core software, allowing it to load into every application launched on the tablet.
Coverage Details
Bias Distribution
- 67% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
