This Preinstalled Android Malware Can Hack Any App You Launch on a Device

Newly discovered Android malware has been found preinstalled on several Android tablet models, allowing it to tamper with any mobile app launched on the device.

Antivirus provider Kaspersky discovered the malware, dubbed “Keenadu,” which the company has detected on over 13,000 devices in Europe, Japan, Brazil, and elsewhere.

In some cases, the malware has been found in the tablets’ firmware, indicating that someone in the supply chain secretly loaded the malicious code. “In this variant, Keenadu is a fully functional backdoor that provides the attackers with unlimited control over the victim’s device,” Kaspersky warns.

The affected tablets were traced to a little-known Chinese brand called Alldocube, which previously sold products on Amazon and is currently on AliExpress. Kaspersky first examined firmware from 2023 on the Alldocube iPlay 50 mini Pro tablet, and found it contained the Keenadu backdoor.

The tablet

(Credit: Alldocube)

“Notably, all subsequent firmware versions for this model also proved to be infected.” This included firmware versions after Alldocube disclosed in 2024 that the tablet model had encountered a “virus attack” that could trigger it to display random Google ads.

The Keenadu backdoor is particularly dangerous because it “can infect every app installed on the device, install any apps from APK (Android Package Kit) files and give them any available permissions,” Kaspersky says. “As a result, all information on the device, including media, messages, banking credentials, location, etc. can be compromised. The malware even monitors search queries that the user inputs into the Chrome browser in incognito mode.”

It also looks like the malware can be hard to remove, since it loads from the device’s firmware, which stores the configuration settings needed to boot the hardware. Despite the capabilities, Kaspersky has only observed the malware engaging in various forms of ad fraud, “with attackers using infected devices as bots to deliver link clicks on ads.”

how the attack works

(Credit: Kaspersky)

The antivirus provider also uncovered evidence that the malware has been preinstalled on devices from other manufacturers. The company didn’t name the brands, but said “in all instances, the backdoor is embedded within tablet firmware. We have notified these vendors about the compromise.”

In addition, Keenadu has been circulating through preinstalled “system” apps, including one “responsible for unlocking the device with the user’s face,” Kaspersky says. The malware has also appeared on the Google Play Store through third-party mobile apps for smart home cameras.

Recommended by Our Editors

Malware Hidden in Pirated Games Infects 400,000 Devices

Think You’ve Been Hacked? Here’s What You Must Do Before It’s Too Late

Fake Version of Popular Archiver Site Is Distributing Malware, Taking Over PCs

The apps

(Credit: Kaspersky)

These apps received over 300,000 downloads but had far fewer capabilities and focused on launching an “invisible web browser” to secretly look up websites, likely for ad fraud. Google has since removed them from its app store after Kaspersky flagged the threat.

Interestingly, Kaspersky’s investigation found the malware won’t activate if “the language set on the device is one of Chinese dialects, and the time is set to one of Chinese time zones.” The malware also won’t launch if the Google Play Store hasn’t been installed.

The research underscores the potential danger of buying cheap Android devices from unknown brands. A year ago, Kaspersky found another malware strain preinstalled on counterfeit Android phones. Alldocube didn’t immediately respond to a request for comment.

Researchers Show Copilot and Grok Can Be Abused as Malware C2 Proxies

Building the Next Generation of Cybersecurity Professionals

Keenadu Firmware Backdoor Infects Android Tablets via Signed OTA Updates

Cyberstar and Pluralsight Unveil Integrated Solution for DoD 8140 Cyber Workforce Readiness