Kaspersky discovers Keenadu – a multifaceted Android malware that can come preinstalled on new devices

Kaspersky has detected a new malware for Android devices that it dubbed Keenadu. This malware is distributed in multiple forms – it can be preinstalled directly into devices’ firmware, embedded within system apps, or even downloaded from official app stores such as Google Play. Currently Keenadu is used for ad fraud, with attackers using infected devices as bots to deliver link clicks on ads, but it can also be used for malicious purposes, with some variants even allowing full control of the victim’s device.

As of February 2026, Kaspersky mobile security solutions detected over 13,000 devices infected with Kee…