Keenadu Android Backdoor Infects Firmware, Spreads via Google Play for Remote Control Access
A new Android malware, identified as Keenadu, has been discovered infecting device firmware during the build stage and disseminating through Google Play applications. This malware allows attackers to remotely control affected tablets and phones.
A new Android malware, identified as Keenadu, has been discovered infecting device firmware during the build stage and disseminating through Google Play applications. This malware allows attackers to remotely control affected tablets and phones.
Detailed analyses, published on Mon, Feb 16, 2026, indicate that Keenadu operates similarly to the Triada Trojan by integrating with the Zygote process, affecting all applications launched on the device.
In April 2025, Kaspersky highlighted Triada's firmware compromises in counterfeit Android devices, leading to the discovery of Keenadu in firmware from manufacturers such as Alldocube. Keenadu incorporates a malicious static library, libVndxUtils.a (MD5: ca98ae7ab25ce144927a46b7fee6bd21), into libandroid_runtime.so during firmware compilation.
Once installed, typically via OTA updates, the malware decrypts payloads using RC4, loads them with DexClassLoader into /data/dalvik-cache/, and creates a client-server framework with AKClient in applications and AKServer in system_server.
Keenadu modifies the println_native method in libandroid_runtime.so to invoke __log_check_tag_count, decrypting and executing com.ak.test.Main. It avoids applications from Google, Sprint, and T-Mobile, utilizes binder IPC for inter-process control, and evades detection.
AKServer facilitates permission management, geolocation, and data exfiltration, while MainWorker communicates with C2 servers decrypted from AES-128, using keys derived from MD5 of the string "ota.host.ba60d29da7fd4794b5c5f732916f7d5c".
Captured payloads target browsers for search hijacking, launchers for session tracking, and shopping applications like Amazon and SHEIN for loading APKs. Modules such as Nova/Phantom clicker employ ML/WebRTC for ad fraud and embed in facial recognition services, using DSA signatures, MD5 checks, and AES decryption before execution.
The supply chain compromise includes signed firmware from brands like Alldocube, revealing developer paths and artifacts, with infections extending beyond Alldocube devices.
This malware allows attackers to remotely control affected tablets and phones.
Standalone applications on Google Play, such as smart camera software with over 300,000 downloads, and Xiaomi GetApps have been found with embedded modules. Google has removed these applications following notification.
Kaspersky identifies Keenadu variants as HEUR:Backdoor.AndroidOS.Keenadu., Trojan-Downloader.AndroidOS.Keenadu., and Trojan-Dropper.AndroidOS.Gegu.*.
Type Indicator Description
MD5 ca98ae7ab25ce144927a46b7fee6bd21 libVndxUtils.a malicious library
MD5 4c4ca7a2a25dbe15a4a39c11cfef2fb2 Keenadu loader module
MD5 912bc4f756f18049b241934f62bfb06c Chrome hijacker
MD5 f0184f6955479d631ea1b1ea0f38a35d Nova/Phantom clicker
IP 67.198.232.4, 67.198.232.187 C2 resolutions
Domain keepgo123.com, gsonx.com Early C2 domains
Path /ak/api/pts/v4 C2 endpoint
Keenadu is linked to Triada, BADBOX, and Vo1d botnets through shared code, C2 overlaps, and payload distributions. BADBOX utilizes Keenadu loaders, while Triada includes credential stealers. The malware has affected over 13,715 users globally, with significant cases in Russia, Japan, Germany, and Brazil.
For remediation, it is recommended to update firmware where clean versions are available, disable infected system applications using ADB, uninstall sideloaded applications, and avoid device use until updates are applied. This threat highlights the risks associated with firmware supply chains, necessitating vendor audits and verified boot procedures.
Based on reporting by Cyber Security News.