Malware - Android Devices Ship with Keenadu Firmware Threat
Basically, some Android phones come with hidden malware that helps steal money through ads.
Keenadu malware is found in Android firmware, allowing attackers to control devices for ad fraud. Affected models include low-cost Android phones. Users should update firmware and monitor for unusual activity.
What Happened
In late February 2026, SophosLabs analysts uncovered a significant threat affecting Android devices. The Keenadu malware was identified as a firmware-level infection, meaning it is embedded deeply within the device's operating system. This malware injects itself into the Zygote process, which is crucial for running all Android applications. As a result, attackers gain total control over infected devices.
Keenadu acts as a downloader for additional malicious modules, targeting various applications. This malware is not just a standalone threat; it facilitates ad fraud by silently generating pay-per-click revenue through background activities. The implications of this malware are severe, as it can affect a wide range of applications from popular storefronts to social media platforms.
Who's Being Targeted
The Keenadu malware primarily targets low-cost Android devices produced by manufacturers such as BLU, Gigaset, and Ulefone. These devices are particularly vulnerable due to their firmware being compromised during the manufacturing phase. As of early March 2026, over 500 unique compromised devices were detected across nearly 50 models, indicating a widespread issue.
The malware's reach is global, with infections reported in 40 countries. This raises concerns for organizations that allow employees to access corporate resources from personal devices, as the malware could expose sensitive data and credentials stored within apps.
Signs of Infection
Identifying infections can be tricky, as Keenadu operates at a firmware level. However, certain system-level APK files like PriLauncher.apk and PriLauncher3QuickStep.apk have been flagged as malicious. These files are integral to the Android operating system, making detection challenging without specific security measures.
Users may notice unusual behavior on their devices, such as unexpected ads or slower performance. If your device is among the affected models, it’s crucial to remain vigilant for signs of infection and take immediate action to protect your data.
How to Protect Yourself
To mitigate the risks associated with Keenadu, users should install updated firmware as soon as it becomes available from their device manufacturers. Until then, organizations should consider restricting access to corporate networks for affected models. Regularly monitor devices for any unusual activity and ensure that security measures are in place.
Sophos recommends following their guidelines outlined in article KBA-000047016 for further protection. Users should also stay informed about any new developments related to this malware to ensure their devices remain secure.
Sophos News