ⓘ Tima Miroshnichenko, Google, edited
Kaspersky Labs researchers recently identified the sophisticated malware, which, alarmingly, is sometimes found pre-installed on modern Android devices. The discovery highlights the ongoing challenges in securing the Android ecosystem and the potential for malicious software to infiltrate devices before they even reach consumers.
Keenadu can infect devices through over-the-air (OTA) update packages, silently embedding itself within the device’s firmware. It can also be delivered via unofficial app installers and, in some cases, even through the official Google Play Store.
The malware provides attackers with extensive access to compromised devices, including system data, personal files and sensitive information. It also allows for the installation of applications without user consent, according to Kaspersky. Currently, the malware appears to be primarily used for ad fraud.
The following applications have been discovered as infected by Kaspersky:
The origin of the malware remains unclear, but researchers noted that it does not activate if it detects time zones or a location within China, or if the Google Play Store is not found on the device. The absence of the Play Store is notable, as it is not officially available in China.
The malware has been found on numerous devices, including the iPlay 50 Mini Pro manufactured by Alldocube. Alldocube, a Chinese company, previously acknowledged that its OTA update channels had been compromised, as reported by BleepingComputer.
As of this writing, Kaspersky reports that Keenadu has affected over 13,000 victims, with the majority of impacted devices located in Japan, Russia, the Netherlands, Germany, and Brazil.
Unfortunately, if a device is infected, replacing it with a new model from a more reputable manufacturer is often the most effective solution. The malware integrates so deeply into the device’s firmware that removal is practically impossible. While obtaining firmware from another provider is possible, it carries its own risks, such as incompatibility.
