Keenadu Android Firmware Backdoor Distributed via Compromised Builds and OTA Updates

Researchers reported Keenadu, a multi-stage Android backdoor implanted during the firmware build process by linking a malicious static library into libandroid_runtime.so, then injecting into the Zygote process so its code is mapped into every app at launch—behavior that mirrors the earlier Triada firmware compromise seen in counterfeit devices. The backdoor has been observed across multiple device brands (including tablets) and in several cases the compromised firmware was delivered via OTA updates, giving operators broad, persistent access at the system level.

Technical analysis indicates Keenadu modifies runtime behavior to decrypt and execute additional components, loading payloads dynamically (e.g., via DexClassLoader) and using a client/server-style architecture on-device to enable remote control and data access. Intercepted modules were tailored to the victim’s installed apps and included capabilities such as browser search hijacking, install/monetization fraud, and stealthy interaction with advertising elements; reporting also notes distribution pathways involving apps on Google Play and links between at least one Keenadu payload and code found embedded in numerous standalone apps, suggesting a broader ecosystem of related Android botnet activity.