The tablet conqueror and the links between major Android botnets

A new Android backdoor called Keenadu has been discovered embedded in the firmware of several tablet brands. It infects the libandroid_runtime.so library during firmware building, injecting itself into every app launched on the device. Keenadu provides attackers unrestricted control over victims' devices, primarily for ad fraud purposes. The investigation revealed connections between Keenadu and other major Android botnets like Triada, BADBOX, and Vo1d. The malware was found in system apps, Google Play apps, and modified versions of popular apps. Over 13,000 users worldwide have been affected, with Russia, Japan, Germany, Brazil and the Netherlands seeing the highest number of infections.

• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software VendorsMalware2026-10-22
• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI CredentialsMalware2026-10-21
• LiteLLM supply chain compromiseCampaign2026-10-22
• Multiple Lenovo Tablets shipped with a known private test key for Android Verified BootHighVulnerability2026-10-20
• AOMEI Backupper update servers hijacked to push malware: Check your PCMalware2026-10-19