Loading story…
Researchers reported Keenadu, a multi-stage Android backdoor implanted during the firmware build process by linking a malicious static library into libandroid_runtime.so, then injecting into the Zygote process so its code is mapped into every app at launch—behavior that mirrors the earlier Triada firmware compromise seen in counterfeit devices. The backdoor has been observed across multiple device brands (including tablets) and in several cases the compromised firmware was delivered via OTA updates, giving operators broad, persistent access at the system level.
Technical analysis indicates Keenadu modifies runtime behavior to decrypt and execute additional components, loading payloads dynamically (e.g., via DexClassLoader) and using a client/server-style architecture on-device to enable remote control and data access. Intercepted modules were tailored to the victim’s installed apps and included capabilities such as browser search hijacking, install/monetization fraud, and stealthy interaction with advertising elements; reporting also notes distribution pathways involving apps on Google Play and links between at least one Keenadu payload and code found embedded in numerous standalone apps, suggesting a broader ecosystem of related Android botnet activity.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Kaspersky said telemetry showed 13,715 users had encountered Keenadu or its modules, with the highest counts in Russia, Japan, Germany, Brazil, and the Netherlands. The company also stated it notified affected vendors and advised users to install clean firmware or avoid using infected devices until remediation was available.
Investigators reported technical and operational overlaps between Keenadu and major Android botnets including Triada, BADBOX, and Vo1d, with evidence that BADBOX could deploy a Keenadu loader variant. Kaspersky did not publicly attribute the activity to a specific threat actor.
Technical analysis showed Keenadu operates through an AKClient/AKServer architecture that can load arbitrary DEX payloads into targeted apps. Observed modules performed ad-click fraud, Chrome search hijacking, install attribution abuse, shopping-app manipulation, and collection of device identifiers and search queries.
Kaspersky found additional Keenadu variants hidden in system apps, modified apps from unofficial sources, third-party stores such as Xiaomi GetApps, and some apps distributed through Google Play. These app-borne variants extended distribution beyond preloaded firmware infections.
Researchers confirmed Keenadu in publicly available, digitally signed firmware images for Alldocube tablets, including iPlay 50 mini Pro variants. The backdoor was present across all checked firmware versions, and some infections were also delivered through OTA updates.
Kaspersky determined that the Keenadu backdoor was inserted during Android firmware compilation by linking a malicious static library into libandroid_runtime.so, indicating a supply-chain compromise rather than post-release tampering. The malware was designed to inject into the Zygote process so its code would load into every app on infected devices.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 109 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
8 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcetherecord.media
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcedarkreading.com
Open sourcehelpnetsecurity.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky researchers reported that the **Keenadu** Android backdoor was used to compromise tablet devices and showed technical links to several major Android botnets. The malware was described as a multifunctional implant capable of taking control of infected devices, with analysis indicating overlaps in infrastructure, development patterns, and behavior with broader mobile botnet operations. The report said the findings tied Keenadu to an ecosystem of Android malware that has targeted mobile users through persistent backdoor access and botnet-style command-and-control activity. By connecting Keenadu to established Android threat activity, the research highlighted how mobile malware operators can reuse tooling and infrastructure across campaigns to expand infections and maintain remote access on compromised devices.
Jul 12, 2026
Researchers reported a large Android supply-chain compromise in which devices from more than 50 brands were shipped with malware embedded in firmware, allowing attackers to control phones before users installed any apps. Trend Micro said the operation, attributed to **Lemon Group**, implanted **Guerrilla** malware through a tampered zygote-related library and used a core plugin called **Sloth** to fetch modules for SMS interception, proxying, cookie theft, WhatsApp abuse, ad fraud, and silent app installation. Telemetry and actor-hosted data indicated activity across more than 180 countries, hundreds of thousands of mobile numbers used for OTP requests, and millions of potentially affected devices, with the business later rebranded in part from Lemon SMS to Durian Cloud SMS while keeping backend infrastructure. The findings echo earlier reporting on **Triada**, an Android malware family that evolved from a rooting trojan into a preinstalled system-image backdoor embedded in framework components. Google previously said Triada abused privileged contexts such as **System UI** and **Google Play** to execute code, monitor foreground apps, replace ads, and install applications so they appeared to come from Google Play, and that infections were inserted into device images during production by a third party using the names **Yehuo** or **Blazefire**. Trend Micro said the newer Guerrilla campaign showed infrastructure overlap with Triada operators, suggesting a continuing ecosystem of firmware-level Android compromise monetized through fraud, silent installs, and persistent device backdoors.
Aug 21, 2026
Researchers detailed **Triada**, a modular Android Trojan that gains unauthorized root privileges through an ecosystem of rooting malware and ad-fraud botnets, then embeds itself in system application directories to survive reboots and evade removal. The malware downloads additional modules directly into memory, collects device identifiers and installed-app data, and communicates with hard-coded command-and-control servers while storing encrypted configuration data locally. Triada’s most notable capability is patching Android’s **Zygote** process so its code is injected into nearly every app launched on an infected device, giving it broad visibility and control across the system. Operators used that access to monetize infections through **SMS fraud**, intercepting and altering outgoing messages tied to in-app payments so charges were redirected to attacker-controlled numbers, while filtering incoming SMS and hiding malicious packages, processes, and services from users and security tools.
Aug 14, 2026