Loading story…
Kaspersky researchers reported that the Keenadu Android backdoor was used to compromise tablet devices and showed technical links to several major Android botnets. The malware was described as a multifunctional implant capable of taking control of infected devices, with analysis indicating overlaps in infrastructure, development patterns, and behavior with broader mobile botnet operations.
The report said the findings tied Keenadu to an ecosystem of Android malware that has targeted mobile users through persistent backdoor access and botnet-style command-and-control activity. By connecting Keenadu to established Android threat activity, the research highlighted how mobile malware operators can reuse tooling and infrastructure across campaigns to expand infections and maintain remote access on compromised devices.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published research on the Keenadu Android backdoor, describing its capabilities and links between major Android botnets. No earlier discrete events are provided in the reference content.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported **Keenadu**, a multi-stage Android backdoor implanted **during the firmware build process** by linking a malicious static library into `libandroid_runtime.so`, then **injecting into the Zygote process** so its code is mapped into every app at launch—behavior that mirrors the earlier **Triada** firmware compromise seen in counterfeit devices. The backdoor has been observed across multiple device brands (including tablets) and in several cases the compromised firmware was delivered via **OTA updates**, giving operators broad, persistent access at the system level. Technical analysis indicates Keenadu modifies runtime behavior to decrypt and execute additional components, loading payloads dynamically (e.g., via `DexClassLoader`) and using a client/server-style architecture on-device to enable remote control and data access. Intercepted modules were tailored to the victim’s installed apps and included capabilities such as **browser search hijacking**, **install/monetization fraud**, and stealthy interaction with advertising elements; reporting also notes distribution pathways involving **apps on Google Play** and links between at least one Keenadu payload and code found embedded in numerous standalone apps, suggesting a broader ecosystem of related Android botnet activity.
Jun 29, 2026
Reporting on mobile threats in 2025 highlighted sustained, high-volume malicious activity against Android devices, with **adware** dominating detections and a large number of **mobile banking Trojans** observed in the wild. Kaspersky’s telemetry-based review cited **14,059,465** blocked attacks involving malware/adware/unwanted software during 2025, **62%** of detections attributed to adware, and **815,000+** malicious installation packages identified, including **255,000** mobile banking Trojan packages; it also noted discovery of notable threats such as the **Keenadu** preinstalled backdoor, reportedly injected at the manufacturing stage by modifying `libandroid_runtime.so` to load into the address space of apps. Separate analysis of the Android **Massiv** malware described an active **mobile banking fraud** campaign delivered via a trojanized **IPTV app**, emphasizing the risk from apps sourced outside official stores. Massiv was reported to request extensive permissions and use **overlay** techniques to capture credentials and manipulate banking sessions, including monitoring user interactions and enabling fraudulent transactions with limited user visibility—reinforcing that mobile banking threats remain a material subset of the broader mobile malware ecosystem described in 2025 trend reporting.
Jun 29, 2026
Security researchers reported that leaked source code for the Android banking malware **GM Bot** enabled broader criminal reuse of a trojan capable of stealing banking credentials, intercepting SMS messages, and bypassing two-factor authentication. IBM said the malware—also tracked under names including **Slempo**, **Bankosy**, **Acecard**, and **MazarBot**—abused Android activity hijacking on older devices to display fake login overlays on legitimate banking apps, making the leak significant because it lowered the barrier for other actors to build or modify mobile banking trojans. ESET later linked publicly released Android banker and command-and-control source code from a Russian forum to an active banking botnet campaign distributed through trojanized weather apps on **Google Play**. The newer malware, detected as `Trojan.Android/Spy.Banker.HW`, posed as **World Weather**, expanded targeting from 22 Turkish banks to 69 banking apps across Turkey, the UK, Germany, and Austria, and added stronger obfuscation while retaining SMS interception and remote lock and unlock functions. An exposed control panel showed more than **2,800 infected devices**, and the hosting provider removed the C2 server after notification.
Aug 15, 2026