Backdoor Identified on Android Tablets

On February 17, 2026, Kaspersky published a report on “Keenadu,” a backdoor embedded in the firmware of Android tablets. Researchers identified it on devices from several manufacturers, including the Chinese company Alldocube. Cybercriminals reportedly installed Keenadu on tablets during the firmware development phase, likely through a compromised supply chain.

“Suppliers may not have been aware that their devices were infected before being placed on the market,” the Kaspersky report states. “Keenadu is a fully fledged backdoor that allows attackers to gain near-total control of the device,” the researchers added.

Kaspersky identified more than 13,700 infected Android tablets worldwide. The most affected countries, in descending order, are Russia, Japan, Germany, Brazil and the Netherlands. Attackers primarily used Keenadu for advertising fraud. It enabled them to hijack search engines and app installations, thereby exploiting advertising components to generate revenue.

Kaspersky has not attributed the campaign to a specific actor. However, researchers noted that the backdoor disables itself if the interface language is set to a Chinese dialect or if it detects a Chinese time zone. The only way to remove Keenadu is to reinstall a clean version of the firmware. In some cases, fully replacing the device is “the safest solution.”