---
title: New Android Malware Infects 13,000 Devices Through Supply Chain Attack
description: Kaspersky finds "Keenadu" malware in Android firmware, affecting 13,000 devices worldwide and linked to major botnets.
canonical_url: https://codekeeper.co/ticker/keenadu-malware-android-firmware-attack
---

# New Android Malware Infects 13,000 Devices Through Supply Chain Attack

Kaspersky finds "Keenadu" malware in Android firmware, affecting 13,000 devices worldwide and linked to major botnets.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Feb 18, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkeenadu-malware-android-firmware-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkeenadu-malware-android-firmware-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkeenadu-malware-android-firmware-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkeenadu-malware-android-firmware-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkeenadu-malware-android-firmware-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkeenadu-malware-android-firmware-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Kaspersky discovered "Keenadu" malware embedded in Android device firmware from multiple small manufacturers, affecting 13,000 devices globally as of February. The malware infiltrates every app on infected devices through Android's core Zygote process, giving attackers complete remote access. The supply chain attack occurred when compromised firmware reached devices either pre-installed or through legitimate security updates. Russia has the most affected users, followed by Japan, Germany, Brazil, and the Netherlands. Currently used for ad fraud, Keenadu can hijack browser searches, monitor Chrome queries, and manipulate shopping carts on Amazon, Shein, and Temu. Worryingly, researchers found connections between Keenadu and three major Android botnets: BADBOX, Triada, and Vo1d. For firmware-level infections, complete firmware replacement is the only solution. Users should stop using infected devices until fixed. **Source:** [Dark Reading](https://www.darkreading.com/mobile-security/supply-chain-attack-embeds-malware-android-devices)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkeenadu-malware-android-firmware-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkeenadu-malware-android-firmware-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkeenadu-malware-android-firmware-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkeenadu-malware-android-firmware-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkeenadu-malware-android-firmware-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkeenadu-malware-android-firmware-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Ex-Soldier Gets 70 Months for AT&T and Verizon Extortion Sep 28, 2026](https://codekeeper.co/ticker/army-soldier-sentenced-for-cybercrime-and-extortion)

[AWS Fixes Amazon Q Flaw That Let Attackers Steal Cloud Credentials Silently Aug 12, 2026](https://codekeeper.co/ticker/aws-patches-flaw-in-amazon-q-for-vs-code)

[Coordinated Cyberattack Hits 30+ Minnesota Water Systems in 48 Hours Aug 11, 2026](https://codekeeper.co/ticker/minnesota-water-systems-cyberattack)

[Cyberattacks CISA's Three-Day Zimbra Patch Deadline Expires as Exploitation Spreads Aug 28, 2026](https://codekeeper.co/ticker/patch-critical-zimbra-vulnerability-prevent-exploitation)