Know What's Happening in Cybersecurity

New Keenadu Backdoor Found in Android Firmware, Google Play Apps

Kaspersky has uncovered a sophisticated Android backdoor named Keenadu, embedded in firmware of multiple device brands and distributed through compromised OTA updates, system apps, and even Google Play applications. The malware can infiltrate every installed app, grant attackers unrestricted control, and harvest data such as messages, banking credentials, and incognito search queries. As of February 2026, Kaspersky reports 13,000 infected devices across Russia, Japan, Germany, Brazil, and the Netherlands, with the most potent variant residing in firmware. Google confirmed removal of the malicious Play Store apps and highlighted Play Protect’s role in defending users.