Connect with us

Crypto World

Kaspersky finds Keenadu Android malware preinstalled on devices

Published

on

Infected apps on Google Play image 1

Editor’s note: In an era of increasingly covert software supply chain threats, Kaspersky’s Keenadu discovery highlights how malware can slip into devices at multiple points—from preinstalled firmware to apps from official stores. This briefing breaks down what Keenadu is, how it operates, and what consumers and vendors should watch for as mobile devices become more integrated with smart ecosystems. While the study is technical, the takeaway is clear: routine device updates and robust security layers remain essential for staying ahead of evolving threats.

Key points

  • Keenadu is Android malware that can be preinstalled in firmware, embedded in system apps, or downloaded from official stores.
  • Used for ad fraud and can give attackers full control over the device in some variants.
  • As of February 2026, over 13,000 infected devices reported; Russia, Japan, Germany, Brazil and others affected.
  • Variants include firmware-integrated backdoors, system-app implants, and malicious apps on Google Play.
  • Some infected apps on Google Play have been removed; risk persists with other app stores and APKs.

Why this matters

Preinstalled malware threatens users at the earliest moment of device setup, bypassing typical defenses and elevating the risk profile for mobile ecosystems. The Keenadu case underscores the need for rigorous supply-chain verification and proactive security solutions that monitor firmware and app-level integrity.

What to watch next

  • Ongoing updates from Kaspersky on Keenadu variants and distribution vectors.
  • Monitoring for new devices affected via firmware supply chains or app stores.
  • User guidance to apply firmware updates and use reputable security software to detect such threats.

Disclosure: The content below is a press release provided by the company/PR representative. It is published for informational purposes.

Kaspersky finds Keenadu Android malware preinstalled on devices

Kaspersky has detected a new malware for Android devices that it dubbed Keenadu. This malware is distributed in multiple forms – it can be preinstalled directly into devices’ firmware, embedded within system apps, or even downloaded from official app stores such as Google Play. Currently Keenadu is used for ad fraud, with attackers using infected devices as bots to deliver link clicks on ads, but it can also be used for malicious purposes, with some variants even allowing full control of the victim’s device.

As of February 2026, Kaspersky mobile security solutions detected over 13,000 devices infected with Keenadu. The highest numbers of the attacked users have been observed in Russia, Japan, Germany, Brazil, the Netherlands, Turkiye, and other countries have been affected.

Integrated into device firmware

Similar to the Triada backdoor that Kaspersky detected in 2025, some versions of Keenadu are integrated into the firmware of several models of Android tablets at one of the supply chain stages. In this variant, Keenadu is a fully functional backdoor that provides the attackers with unlimited control over the victim’s device. It can infect every app installed on the device, install any apps from APK files and give them any available permissions. As a result, all information on the device, including media, messages, banking credentials, location, etc., can be compromised. The malware even monitors search queries that the user inputs into the Chrome browser in incognito mode.

Advertisement

When integrated into the firmware, the malware behaves differently depending on several factors. It will not activate if the language set on the device is one of Chinese dialects, and the time is set to one of Chinese time zones. It will also not launch if the device doesn’t have Google Play Store and Google Play Services installed.

Embedded within system apps

In this variant, the functionality of Keenadu is limited – it cannot infect every app on the device, but since it exists within a system app (which has elevated privileges compared to usual apps), it can still install any side apps that the attackers choose without the user knowing. What’s more, Kaspersky discovered Keenadu embedded within a system application responsible for unlocking the device with the user’s face. The attackers could potentially acquire victim’s face data. In some cases, Keenadu was embedded within the home screen app which is responsible for the home screen interface.

Embedded within apps distributed through Android app stores

Kaspersky experts also discovered that several apps distributed on Google Play are infected with Keenadu. These are apps for smart home cameras, and they’ve been downloaded over 300,000 times. As of the time of publication, these apps have been removed from Google Play. When the apps are launched, attackers may launch invisible web browser tabs within the apps, that can be used to browse through different websites without the user knowing. Previous research from other cybersecurity researchers also showed similar infected apps being distributed via standalone APK files or through other app stores.

Infected apps on Google Play image 1Infected apps on Google Play image 2

Keenadu infographic image

Infected apps on Google Play

Advertisement

As our recent research showed, preinstalled malware is a pressing issue on multiple Android devices. Without any actions on the user side, a device can be infected right out of the box. It is important for users to understand this risk and use security solutions that can detect this type of malware. Vendors likely didn’t know about the supply chain compromise that resulted in Keenadu infiltrating devices, as the malware was imitating legitimate system components. It is important to check every stage of the production process to ensure that device firmware is not infected,” comments Dmitry Kalinin, security researcher at Kaspersky.

See the post on Securelist for more information.

Recommendations:

  • Use a reliable security solution to be promptly notified of similar threats on your device.
  • If you are using a device with infected firmware, check for firmware updates. After the update, run a scan of the device with a security solution.
  • If a system app is infected, we recommend that users stop using it and then disable it. If a launcher app is infected, we recommend disabling the default launcher and using third-party launchers.

About Kaspersky

Kaspersky is a global cybersecurity and digital privacy company founded in 1997. With over a billion devices protected to date from emerging cyberthreats and targeted attacks, Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative solutions and services to protect individuals, businesses, critical infrastructure and governments around the globe. The company’s comprehensive security portfolio includes leading digital life protection for personal devices, specialized security products and services for companies, as well as Cyber Immune solutions to fight sophisticated and evolving digital threats. We help millions of individuals and nearly 200,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.

Risk & affiliate notice: Crypto assets are volatile and capital is at risk. This article may contain affiliate links. Read full disclosure

Advertisement

Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Crypto World

XRP Ledger rolls out members-only DEX for regulated institutions

Published

on

(XRP Ledger)

The XRP Ledger has activated a new “Permissioned DEX” amendment, a technical upgrade designed to let regulated institutions trade on XRPL without opening markets to everyone.

The change, known as XLS-81, allows the creation of permissioned decentralized exchanges that work like XRPL’s existing built-in DEX, but with a key difference.

(XRP Ledger)

(XRP Ledger)

A permissioned domain can restrict who is allowed to place offers and who is allowed to accept them, creating a gated trading venue where participation can be tied to compliance requirements such as KYC and AML checks.

Advertisement

Think of it as a ‘members only’ marketplace, while still keeping the trading mechanics native to the ledger.

The feature is aimed at banks, brokers and other firms that may want onchain settlement and liquidity but cannot interact with fully open DeFi markets. For these players, the ability to control access is not optional but forms the minimum requirement.

The activation also adds to a growing set of “institutional DeFi” primitives XRPL has been rolling out this month. Token Escrow, or XLS-85, went live last week, extending XRPL’s native escrow system beyond XRP to all trustline-based tokens and Multi-Purpose Tokens, including stablecoins such as RLUSD and tokenized real-world assets.

Together, the two upgrades create a more complete toolkit for regulated finance on XRPL. Token escrow allows conditional settlement for assets issued on the network, while the permissioned DEX provides a controlled venue for trading them.

Advertisement

That combination is central to use cases like tokenized funds, stablecoin FX rails, and regulated secondary markets for tokenized assets.

While the changes are unlikely to matter to most retail traders day to day, they signal XRPL’s direction. It is building infrastructure for institutions first, even if that means leaning into gated markets rather than the fully open DeFi model that defined the last cycle.

Source link

Advertisement
Continue Reading

Crypto World

Aptos (APT) declines 3%, leading index lower

Published

on

9am CoinDesk 20 Update for 2026-02-18: vertical

CoinDesk Indices presents its daily market update, highlighting the performance of leaders and laggards in the CoinDesk 20 Index.

The CoinDesk 20 is currently trading at 1962.18, down 0.9% (-18.81) since 4 p.m. ET on Tuesday.

One of the 20 assets is trading higher.

9am CoinDesk 20 Update for 2026-02-18: vertical

Leaders: CRO (+0.1%) and UNI (-0.3%).

Laggards: APT (-3.0%) and SOL (-2.5%).

Advertisement

The CoinDesk 20 is a broad-based index traded on multiple platforms in several regions globally.

Source link

Advertisement
Continue Reading

Crypto World

MYX closes strategic funding round led by Consensys

Published

on

MYX closes strategic funding round led by Consensys

Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.

MYX has completed and closed a strategic funding round led by Consensys ahead of its V2 launch.

Advertisement

Onchain derivatives protocol MYX has completed a strategic funding round led by Consensys, with participation from Consensys Mesh and Systemic Ventures, ahead of the MYX V2 launch. With the closing of this round, Consensys has officially become the largest investor in MYX. The raise supports the rollout of MYX’s Modular Derivative Settlement Engine, marking the platform’s transition into core infrastructure for omnichain derivatives.

MYX V2 represents a structural shift in how onchain derivatives are built and settled. Rather than operating as a vertically integrated dapp, MYX now serves as a modular settlement layer that other products and platforms can build upon.

At the protocol level, MYX V2 integrates account abstraction via EIP-4337 and EIP-7702 alongside Chainlink’s latest permissionless oracle stack. Together, these components are designed to remove long-standing frictions in onchain trading including slow listings for long-tail assets as well as inefficient use of capital and complex transaction flows.

MYX V2 enables gasless, one-click trading while preserving non-custodial control and introduces a Dynamic Margin system that supports up to 50x leverage without relying on traditional order book depth. This architecture allows MYX to offer oracle-anchored pricing that eliminates slippage for large orders, significantly reducing execution risk for professional traders.

Advertisement

By decoupling liquidity depth from execution quality, MYX aims to eliminate the trade-off between access and execution that onchain perps traders deal with every day. MYX states that with this approach, traders no longer need to wait for deep order books, ladder into positions, or eat slippage when trading size, especially in new or volatile markets. Pricing is anchored directly to oracles rather than transient market depth, allowing positions to be opened and closed at predictable prices regardless of local liquidity conditions.

According to the team, the result is materially lower effective trading costs than underlying spot markets, immediate access to newly emerging assets, and consistent execution even during periods of market stress. These mechanics are not discretionary or market-maker dependent; they are enforced by deterministic economic models, robust margin systems, and conservative security assumptions designed to perform under real trading conditions.

Disclosure: This content is provided by a third party. Neither crypto.news nor the author of this article endorses any product mentioned on this page. Users should conduct their own research before taking any action related to the company.

Advertisement

Source link

Advertisement
Continue Reading

Crypto World

Bitcoin stays volatile while MUFG says stables work better as money

Published

on

Bitcoin investors face ‘harvest now, decrypt later’ quantum threat

Bitcoin slips ~2% in 7d as MUFG touts stablecoins’ price-stable payments.

An analyst at Mitsubishi UFJ Financial Group has stated that stablecoins represent a more suitable currency option than Bitcoin for payment purposes, according to recent commentary from the Japanese financial institution.

Lee Hardman, an analyst at MUFG, one of Japan’s three largest banks, said stablecoins have attracted increased attention compared to other digital assets due to their function as digital cash.

Advertisement

Hardman stated that stablecoins better fulfill the requirements of money by offering price stability and fast, low-cost payment services, according to the analyst’s assessment. The analyst noted that Bitcoin’s high price volatility limits its use as a daily payment method.

Stablecoins are pegged to fiat currencies and maintain stable value, making them more likely to be used as a medium of exchange and payment, Hardman said.

The comments come as interest in Bitcoin and cryptocurrencies continues to expand globally, with financial institutions increasingly evaluating various digital asset classes for potential use cases.

Advertisement

Source link

Continue Reading

Crypto World

What Happens to ETH if $2K Support Is Decisively Lost?

Published

on

What Happens to ETH if $2K Support Is Decisively Lost?

After the aggressive sell-off toward the $1.8K region, the market has transitioned into choppy consolidation, while lower timeframes are now approaching a decisive breakout point. The key question is whether this compression resolves to the upside or results in continuation within the dominant downtrend structure.

Ethereum Price Analysis: The Daily Chart

On the daily timeframe, Ethereum is exhibiting clear consolidation behaviour following its sharp decline. The price action has become increasingly choppy, reflecting equilibrium between buyers and sellers. Instead of impulsive continuation, the market is printing overlapping candles with limited directional commitment.

This consolidation is confined between the $1.8K static support base and the channel’s midline acting as dynamic resistance. The mid-boundary of the descending channel continues to cap bullish attempts, preventing a structural trend reversal. Meanwhile, the $1.8K zone remains a strong demand area that has repeatedly absorbed selling pressure.

As long as the price remains trapped between these two boundaries, the primary scenario is range-bound fluctuation. A confirmed breakout above the channel’s midline would open the path toward higher resistance zones, while a breakdown below $1.8K would invalidate the equilibrium and likely trigger another impulsive leg lower.

Advertisement

ETH/USDT 4-Hour Chart

Zooming into the 4-hour timeframe, the market structure becomes more compressed. Ethereum has formed a clear triangle pattern, with descending resistance and rising support squeezing the price into a narrow apex. This pattern reflects volatility contraction and typically precedes an expansion phase.

The asset is now approaching the final portion of the triangle, suggesting that a breakout is imminent. Given the recent higher lows inside the pattern and the improving short-term structure, the probability of an upside breakout is increasing. The targets are clearly defined on the chart, with the first resistance zone aligned with the previously marked supply region above the pattern at the $2.4K area.

However, failure to break upward and a decisive breakdown below the ascending support would shift momentum back in favour of sellers.

Sentiment Analysis

The Binance ETH/USDT liquidation heatmap reveals significant liquidity dynamics around the current range. A dense liquidity cluster is positioned above the current price, indicating a concentration of short liquidation levels. Such clusters often act as magnets, drawing the price upward to trigger liquidations before a potential reaction.

Advertisement

At the same time, a developing liquidity concentration below the market reflects the accumulation of long positions. This suggests that traders are increasingly positioning for upside continuation, building long exposure near the consolidation zone.

The interaction between these liquidity pools increases the likelihood of a volatility expansion. A breakout to the upside could trigger short liquidations above the price, accelerating the move. Conversely, a downside sweep could target the long liquidity cluster before a potential rebound.

Overall, Ethereum is in a compression phase. The daily chart reflects equilibrium within a broader downtrend, the 4-hour chart shows a triangle nearing resolution, and liquidity positioning suggests that a decisive breakout move is approaching.

SPECIAL OFFER (Exclusive)

SECRET PARTNERSHIP BONUS for CryptoPotato readers: Use this link to register and unlock $1,500 in exclusive BingX Exchange rewards (limited time offer).
Advertisement

Disclaimer: Information found on CryptoPotato is those of writers quoted. It does not represent the opinions of CryptoPotato on whether to buy, sell, or hold any investments. You are advised to conduct your own research before making any investment decisions. Use provided information at your own risk. See Disclaimer for more information.

Source link

Advertisement
Continue Reading

Crypto World

AMLBot Says Social Engineering Drove 65% of Crypto Incidents in 2025

Published

on

AMLBot Says Social Engineering Drove 65% of Crypto Incidents in 2025

About two-thirds of crypto incidents investigated by blockchain analytics company AMLBot in 2025 were driven by social engineering rather than technical exploits, according to a report based on the company’s internal casework.

AMLBot said 65% of the incidents it reviewed last year involved access and response failures, such as compromised devices, weak verification and delayed detection, instead of vulnerabilities in blockchains or smart contracts.

The company said its analysis drew on about 2,500 internal investigations and should not be read as an industry-wide measure of crypto crime, according to a Wednesday report shared with Cointelegraph.

Primary attack vectors included device compromises via chat scams, impersonation scams, and other investment and phishing scams involving social manipulation.

Advertisement

Crypto phishing attacks are social engineering schemes that don’t require hacking code. Instead, attackers share fraudulent links to steal victims’ sensitive information, such as the private keys to crypto wallets.

The findings suggest that security improvements at the protocol level may not be enough to protect users if scammers can bypass safeguards by targeting people directly.

Percentage of crypto theft cases by fraud category. Source: AMLBot

Investment scams and phishing lead by case count

Investment scams accounted for the largest share of cases (25%), followed by phishing attacks (18%) and device compromises (13%), as the most damaging categories in terms of case frequency.

Related: 22 Bitcoin worth $1.5M vanish from Seoul police custody

Pig-butchering scams accounted for 8%, over-the-counter (OTC) fraud for 8%, and chat-based impersonation represented 7%, collectively making up the second tier of the most frequent attacks.

Advertisement
Percentage of crypto theft cases per month. Source: AMLBot

Impersonation linked to $9 million in recent losses

AMLBot traced at least $9 million in stolen digital assets to impersonation-related attacks over the past three months.

Impersonation is the most damaging attack vector in terms of social engineering scams, Slava Demchuk, CEO of AMLBot, told Cointelegraph. “Attackers continue to exploit and trick victims with a ruthless game of charades, posing as trusted entities,” he said. “Sometimes they’re exchange support teams, investment partners, project managers or reps.”

Demchuk urged users not to share private keys or recovery phrases and to be wary of urgent requests involving fund transfers or wallet access, which he said are common entry points for social engineering scams.

Related: Binance confirms employee targeted as three arrested in France break-in

To protect against impersonation attacks, Demchuk urged crypto investors not to share their private keys and recovery phrases. 

Advertisement

He also advised investors to ignore “urgent requests involving fund transfers of wallet access,” which are usually the first point of contact for social engineering scams.

CertiK reports January spike in crypto losses

Crypto scams saw an uptick in January, when scammers stole $370 million, the highest monthly figure in 11 months, according to crypto security company CertiK.

Source: CertiK

$311 million of the total value was attributed to phishing scams, with a particularly damaging social engineering scam costing one victim around $284 million.

Magazine: Meet the onchain crypto detectives fighting crime better than the cops

Advertisement