Kaspersky Reveals Keenadu Android Firmware Malware

Security researchers at Kaspersky have uncovered a sophisticated Android malware known as Keenadu, which embeds itself directly into device firmware, allowing attackers to seize remote control of infected smartphones and tablets before users even activate them. The threat, primarily targeting low-cost devices, has compromised approximately 13,700 users worldwide as of early this year, with the highest concentrations in Russia, Japan, Germany, Brazil, and the Netherlands.

Keenadu operates as a multistage backdoor, injecting malicious code into the Android system's Zygote process, which launches every application on the device. This integration loads a copy of the malware into the address space of all apps, granting operators extensive privileges to bypass security restrictions, install additional software, steal sensitive data such as banking credentials and location information, and monitor activities like browser searches—even in incognito mode. Researchers noted that the malware remains dormant on devices set to Chinese language or time zones and those without Google Play Services, suggesting a focus on international markets.

The infection often occurs during the firmware...