Android tablet firmware embedded Keenadu

Keenadu is a firmware-level Android backdoor. Kaspersky traced one public example through Alldocube tablet firmware images, including iPlay 50 mini Pro releases, and found validly signed images containing the malicious changes.

The insertion point was libandroid_runtime.so, a core Android framework library. A malicious static library, libVndxUtils.a, was linked during the build and added code that loaded Keenadu inside Zygote, the parent process for Android applications.

That placement broke the normal app boundary. Keenadu could run in the context of installed apps, collect device metadata, install additional APKs, inject modules into apps such as Chrome and YouTube, hijack search traffic, and simulate ad clicks or app installs.

Kaspersky concluded that a stage of the firmware supply chain was compromised, not merely an OTA download server. The signed images and build artifacts point to malicious code entering before firmware release, so affected tablets could arrive already compromised.