Security researchers are reporting a disturbing case that is significantly different from the usual threats in the Android ecosystem. Several tablet models have been found to have malware embedded directly into the firmware before the devices even reached customers. In other words, users bought the infected tablet straight from the store.
Malware hidden deep in the system
According to Kaspersky's analysis, this is a backdoor called Keenadu. This malicious code does not run as a regular application, but injected directly into the Zygote process, which is the core Android system component behind the launch of all applications.
This gives the attacker virtually unlimited access to the system – they can monitor application installations, redirect web searches, work with advertising modules or download other malicious components. This is significantly more dangerous than a classic malware downloaded from the internet.
Suspected supply chain problem
Researchers cite the tablet as a confirmed example Alldocube iPlay 50 mini ProAll analyzed firmware versions – including newer ones – contained backdoors and were signed with a valid digital certificate. This suggests that the problem was not created by an aftermarket update, but directly during the development or build of the system.
Kaspersky records over 13,700 cases The occurrence of Keenadu and its modules worldwide, with countries such as Russia, Japan, Germany and Brazil being the most affected.
What should users do?
Company Google responded to the findings by saying that users are automatically protected using the service Google Play Protectwhich can make known varianty malware Keenadu can detect, warn about and disable malicious applications. Even if they come from outside Google Play.
This case shows once again that the biggest risk is often not from well-known brands, but from cheap devices from smaller manufacturers, where software development is not under such strict control. If you are using a cheap Android tablet, it's definitely worth checking if the device is Play Protect certified and monitoring the availability of official firmware updates.
