{"id":"keenadu-android-firmware-backdoor-feb-2026","category":"supply-chain","status":"closed","title":"Keenadu Android backdoor found preinstalled in tablet firmware and in Google Play camera apps","tldr":"Kaspersky found Keenadu, an Android backdoor built into some tablets' firmware and hidden in smart-camera apps (300,000+ downloads, now removed). Check your tablet maker for clean firmware, and don't use an infected device for banking or private messages.","summary":"In February 2026 Kaspersky disclosed Keenadu, an Android malware family that reaches devices in three ways: built into the firmware of several tablet models before sale, embedded in system apps (including a face-unlock service and a home-screen launcher), and hidden in smart-camera apps on Google Play. Kaspersky's products had detected it on more than 13,000 devices, mostly in Russia, Japan, Germany, Brazil and the Netherlands. The firmware version is a full backdoor: it can run inside every app, install other apps, grant itself permissions, and reach messages, media, location and banking credentials. Its main use so far is ad fraud. The camera apps were downloaded over 300,000 times and Google removed them after being alerted. The best-documented case is the Alldocube iPlay 50 mini Pro, with infected firmware dating from August 2023, some delivered as over-the-air updates. The malware sits on the read-only system partition, so it cannot be removed with normal Android tools. Alldocube has released firmware that Kaspersky found clean; the status for other affected brands is not stated. Kaspersky described the compromise as a supply-chain attack.","action":"If you own a budget Android tablet, check the maker's site for a firmware update and install it, then scan with a reputable security app. If none is available, avoid banking or private messages on it, and uninstall any unfamiliar smart-camera app.","product":"Android tablets with infected firmware (including Alldocube iPlay 50 mini Pro) and smart-camera apps on Google Play","audience":"home","severity":"high","patch":"partial","exploited":true,"cves":[],"tags":["android","keenadu","supply-chain","firmware","tablet","backdoor","kaspersky","ad-fraud"],"affected":["Alldocube iPlay 50 mini Pro (T811M) firmware from 18 August 2023 onward","Alldocube iPlay 50 mini Pro NFE firmware after the first 7 November 2023 release","Other Android tablet models from several brands (not all named by Kaspersky)","Smart-camera apps on Google Play (removed)"],"fixed":["Newer Alldocube firmware versions that Kaspersky checked and found clean"],"matches":[],"sources":[{"kind":"advisory","title":"Kaspersky discovers Keenadu, a multifaceted Android malware that can come preinstalled on new devices","url":"https://www.kaspersky.com/about/press-releases/kaspersky-discovers-keenadu-a-multifaceted-android-malware-that-can-come-preinstalled-on-new-devices","by":"Kaspersky","date":"2026-02-17"},{"kind":"research","title":"Divide and conquer: how the new Keenadu backdoor exposed links between major Android botnets","url":"https://securelist.com/keenadu-android-backdoor/118913/","by":"Kaspersky Securelist","date":"2026-02-17"}],"started":"2026-02-17","closed":"2026-02-17","created":"2026-11-03T21:24:38.003Z","updated":"2026-11-03T21:24:38.003Z","cve_notes":[],"timeline":[{"at":"2026-02-17","added":"2026-11-03T21:23:52.346Z","kind":"new-fix","text":"Kaspersky's write-up says Alldocube has since released several new firmware versions, and the ones Kaspersky checked are not infected. Other affected vendors' fix status is not stated in the pages read.","url":"https://securelist.com/keenadu-android-backdoor/118913/","by":"Kaspersky Securelist","patch":"partial"},{"at":"2026-02-17","added":"2026-11-03T21:23:52.346Z","kind":"other","text":"Kaspersky's technical write-up said the infected camera apps were removed from Google Play after it alerted Google. It named Alldocube iPlay 50 mini Pro firmware from 18 August 2023 onward as infected, and said the vendors had been notified.","url":"https://securelist.com/keenadu-android-backdoor/118913/","by":"Kaspersky Securelist","patch":null},{"at":"2026-02-17","added":"2026-11-03T21:23:52.346Z","kind":"disclosed","text":"Kaspersky published its research on Keenadu, an Android backdoor found built into the firmware of several tablet models, in some system apps, and in smart-camera apps on Google Play. It reported more than 13,000 infected devices and over 300,000 downloads of the camera apps.","url":"https://www.kaspersky.com/about/press-releases/kaspersky-discovers-keenadu-a-multifaceted-android-malware-that-can-come-preinstalled-on-new-devices","by":"Kaspersky","patch":"none"}],"url":"https://hard.fyi/live/keenadu-android-firmware-backdoor-feb-2026/","json":"https://hard.fyi/api/live?id=keenadu-android-firmware-backdoor-feb-2026"}