Editor’s note: In an era of increasingly covert software supply chain threats, Kaspersky’s Keenadu discovery highlights how malware can slip into devices at multiple points—from preinstalled firmware to apps from official stores. This briefing breaks down what Keenadu is, how it operates, and what consumers and vendors should watch for as mobile devices become more integrated with smart ecosystems. While the study is technical, the takeaway is clear: routine device updates and robust security layers remain essential for staying ahead of evolving threats.

Key points

• Keenadu is Android malware that can be preinstalled in firmware, embedded in system apps, or downloaded from official stores.
• Used for ad fraud and can give attackers full control over the device in some variants.
• As of February 2026, over 13,000 infected devices reported; Russia, Japan, Germany, Brazil and others affected.
• Variants include firmware-integrated backdoors, system-app implants, and malicious apps on Google Play.
• Some infected apps on Google Play have been removed; risk persists with other app stores and APKs.

Why this matters

Preinstalled malware threatens users at the earliest moment of device setup, bypassing typical defenses and elevating the risk profile for mobile ecosystems. The Keenadu case underscores the need for rigorous supply-chain verification and proactive security solutions that monitor firmware and app-level integrity.

What to watch next

• Ongoing updates from Kaspersky on Keenadu variants and distribution vectors.
• Monitoring for new devices affected via firmware supply chains or app stores.
• User guidance to apply firmware updates and use reputable security software to detect such threats.

Disclosure: The content below is a press release provided by the company/PR representative. It is published for informational purposes.

Kaspersky finds Keenadu Android malware preinstalled on devices

Kaspersky has detected a new malware for Android devices that it dubbed Keenadu. This malware is distributed in multiple forms – it can be preinstalled directly into devices’ firmware, embedded within system apps, or even downloaded from official app stores such as Google Play. Currently Keenadu is used for ad fraud, with attackers using infected devices as bots to deliver link clicks on ads, but it can also be used for malicious purposes, with some variants even allowing full control of the victim’s device.

As of February 2026, Kaspersky mobile security solutions detected over 13,000 devices infected with Keenadu. The highest numbers of the attacked users have been observed in Russia, Japan, Germany, Brazil, the Netherlands, Turkiye, and other countries have been affected.

Integrated into device firmware

Similar to the Triada backdoor that Kaspersky detected in 2025, some versions of Keenadu are integrated into the firmware of several models of Android tablets at one of the supply chain stages. In this variant, Keenadu is a fully functional backdoor that provides the attackers with unlimited control over the victim’s device. It can infect every app installed on the device, install any apps from APK files and give them any available permissions. As a result, all information on the device, including media, messages, banking credentials, location, etc., can be compromised. The malware even monitors search queries that the user inputs into the Chrome browser in incognito mode.

When integrated into the firmware, the malware behaves differently depending on several factors. It will not activate if the language set on the device is one of Chinese dialects, and the time is set to one of Chinese time zones. It will also not launch if the device doesn’t have Google Play Store and Google Play Services installed.

Embedded within system apps

In this variant, the functionality of Keenadu is limited – it cannot infect every app on the device, but since it exists within a system app (which has elevated privileges compared to usual apps), it can still install any side apps that the attackers choose without the user knowing. What’s more, Kaspersky discovered Keenadu embedded within a system application responsible for unlocking the device with the user’s face. The attackers could potentially acquire victim’s face data. In some cases, Keenadu was embedded within the home screen app which is responsible for the home screen interface.

Embedded within apps distributed through Android app stores

Kaspersky experts also discovered that several apps distributed on Google Play are infected with Keenadu. These are apps for smart home cameras, and they’ve been downloaded over 300,000 times. As of the time of publication, these apps have been removed from Google Play. When the apps are launched, attackers may launch invisible web browser tabs within the apps, that can be used to browse through different websites without the user knowing. Previous research from other cybersecurity researchers also showed similar infected apps being distributed via standalone APK files or through other app stores.

Infected apps on Google Play

As our recent research showed, preinstalled malware is a pressing issue on multiple Android devices. Without any actions on the user side, a device can be infected right out of the box. It is important for users to understand this risk and use security solutions that can detect this type of malware. Vendors likely didn’t know about the supply chain compromise that resulted in Keenadu infiltrating devices, as the malware was imitating legitimate system components. It is important to check every stage of the production process to ensure that device firmware is not infected,” comments Dmitry Kalinin, security researcher at Kaspersky.

See the post on Securelist for more information.

Recommendations:

• Use a reliable security solution to be promptly notified of similar threats on your device.
• If you are using a device with infected firmware, check for firmware updates. After the update, run a scan of the device with a security solution.
• If a system app is infected, we recommend that users stop using it and then disable it. If a launcher app is infected, we recommend disabling the default launcher and using third-party launchers.

About Kaspersky

Kaspersky is a global cybersecurity and digital privacy company founded in 1997. With over a billion devices protected to date from emerging cyberthreats and targeted attacks, Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative solutions and services to protect individuals, businesses, critical infrastructure and governments around the globe. The company’s comprehensive security portfolio includes leading digital life protection for personal devices, specialized security products and services for companies, as well as Cyber Immune solutions to fight sophisticated and evolving digital threats. We help millions of individuals and nearly 200,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.

US tax filers may see bigger refunds in 2026 compared with previous years, a development one Wall Street strategist said could lift risk appetite for tech stocks and digital assets favored by retail investors. In a note cited by CNBC, Wells Fargo analyst Ohsung Kwon estimated that a wave of larger refunds could revive the so‑called “YOLO” trade, with as much as $150 billion potentially flowing into equities and Bitcoin by the end of March. The extra cash could be most visible among higher-income consumers, according to the note.

Key takeaways

• The Wells Fargo projection suggests up to $150 billion in fresh liquidity could reach equities and Bitcoin by the end of March, signaling a potential near‑term risk-on push if refunds materialize as expected.
• Higher‑income households are identified as the primary beneficiaries of the refund wave, which could amplify appetite for volatile, high‑beta assets alongside traditional tech bets.
• Liquidity may flow into Bitcoin and stocks popular with retail traders, including platforms like Robinhood and large cap names such as Boeing, depending on how sentiment evolves.
• Crypto demand remains sentiment‑driven: positive momentum could attract new funds, while lack of enthusiasm may prompt investors to shift to assets with stronger near‑term momentum.
• The macro backdrop includes policy changes tied to the One Big Beautiful Bill Act, signed in mid‑2025, which policymakers argued would trim federal spending and reshape tax refunds in 2025 and beyond.

Tickers mentioned: $BTC, $ETH

Sentiment: Neutral

Price impact: Neutral

Market context: In liquidity cycles, tax refunds frequently influence risk appetite, and 2026 could test how retail cash infusions translate into crypto and tech equity demand amid shifting policy signals and macro dynamics.

Why it matters

The intersection of tax policy, consumer liquidity, and retail trading trends has long shaped short‑term risk sentiment in crypto markets. If the refund wave materializes as projected, Bitcoin and other digital assets could see fresh attention from buyers who previously favored high‑growth tech stocks. The timing is notable because refunds are expected to be most visible among higher‑income segments, a cohort historically more active in discretionary investing. This could amplify trading activity in early spring, with price action potentially moving in tandem with broader equity flows as investors rebalance portfolios around tax season liquidity.

On the policy side, the so‑called One Big Beautiful Bill Act, signed on July 4, 2025, is cited as a driver of larger refunds in 2025 and beyond. Proponents argued the measure would curb federal spending and reshape the fiscal landscape, creating a more favorable environment for household cash returns during tax filing periods. The exact allocation of this liquidity remains uncertain, but the implication is that macro signals could feed through to risk assets, including digital currencies, if investor confidence strengthens alongside improving sentiment in crypto markets.

From a market‑structure perspective, the narrative dovetails with ongoing activity from both retail traders and large holders. While some liquidity could tilt toward Bitcoin and equities, others may seek alternative assets with strong momentum or social traction. Observers note that the retail‑oriented ecosystem—platforms and apps that higher‑income consumers already use—could be pivotal in determining where the money lands. The dynamic is further complicated by divergent views on crypto’s near‑term trajectory, with “smart money” positioning painting a mixed picture of risk tolerance in the current cycle.

What to watch next

• Monitor the February–March refund cycle for material evidence of inflows into Bitcoin and consumer tech equities, as highlighted in the Wells Fargo note reported by CNBC.
• Track sentiment indicators across crypto markets; if retail sentiment turns positive, expect increased on‑ramps into digital assets and a potential uptick in on‑chain activity.
• Watch whale and smart‑money behavior for Bitcoin and Ether to gauge whether larger players are dialing up or dialing back exposure as liquidity shifts emerge.
• Observe policy developments and fiscal signals tied to the One Big Beautiful Bill Act to assess any shifts in tax refunds that could influence liquidity cycles.
• Observe the performance of retail‑favorable names like Robinhood and Boeing, which were cited as potential beneficiaries of broader liquidity recovery in a risk‑on environment.

Sources & verification

• CNBC coverage of Wells Fargo analyst Ohsung Kwon’s note on a potential $150 billion refund‑driven inflow into equities and Bitcoin by the end of March 2026.
• Nansen data on “smart money” positioning, including Bitcoin net short exposure and Ether accumulation across multiple wallets.
• The One Big Beautiful Bill Act, signed into law on July 4, 2025, which proponents say shaped tax refund dynamics in 2025 and onward.

Tax refunds, sentiment and the crypto liquidity swing in 2026

As 2026 unfolds, a wave of larger tax refunds could reshape the risk appetite that has underpinned a portion of the crypto market in recent years. Wells Fargo’s Ohsung Kwon, in a note highlighted by CNBC, argues that an acceleration in refunds could reignite a “YOLO” trading mindset among investors who are flush with tax cash. He estimates that as much as $150 billion could move into equities and Bitcoin by the end of March, with the strongest buoyancy likely concentrated among higher‑income households. The framing is important: this is not a guaranteed market impulse, but a liquidity signal that could steer behavior if consumer confidence remains intact and risk appetite returns after a period of uncertainty.

Bitcoin (BTC) demand, the analyst notes, could be highly sentiment dependent. If retail investors rally around crypto assets, new funds might flow into the space, potentially lifting demand for tokens across the sector. Conversely, if sentiment falters, investors may pivot toward assets with more immediate momentum and social traction. The study highlights a dynamic tension: crypto markets often ride the same liquidity waves as the broader stock market, but the timing and magnitude of inflows can diverge based on macro cues and the perceived staying power of the rally.

Adding nuance, Nicolai Sondergaard, a research analyst at Nansen, emphasizes that sentiment acts as a gating factor. “If sentiment starts to come around and retail sees positive upwards momentum in crypto assets, I see that as increasing the likelihood of funds flowing in this direction,” he told Cointelegraph. The caveat is clear: a lack of enthusiasm could encourage retail traders to seek assets with stronger near‑term momentum, potentially dampening crypto inflows even if refunds are robust. The outcome hinges not just on the size of the refunds but on how widely the wind shifts from caution to confidence across the retail trading ecosystem.

The macro backdrop remains complex. The policy shift tied to the One Big Beautiful Bill Act, signed into law in 2025, is frequently cited as a contributor to the broader liquidity environment. While the bill’s supporters framed it as a measure to trim federal spending and reallocate resources, critics warned of unintended consequences for the pace and distribution of tax refunds. In practice, liquidity—in the form of refunds and discretionary cash—can influence trading dynamics across both traditional equities and digital assets. In this context, crypto developers and market participants are watching not only on‑chain data but also the evolving policy landscape that could redefine the cushion of available capital for speculative bets.

On the supply side, market participants have shown a bifurcated stance. While some whales continue to accumulate spot Ether across multiple wallets, the smart‑money cohort has been net short on Bitcoin for a sizable cumulative amount, according to Nansen’s metrics. The divergence underscores a market where large holders are positioning for different outcomes than the broader retail narrative. It also implies that any rebound in risk appetite could be tested by how quickly the composition of buyers shifts from traders favoring short‑term profits to investors willing to hold through volatility. In the near term, the liquidity landscape remains unsettled, and the pace of inflows will likely hinge on a confluence of sentiment, policy signals, and on‑chain activity.

What to watch next (summary)

• Early‑spring refund data and corresponding flows into Bitcoin and select equities to confirm the magnitude of the YOLO bid.
• Shifts in retail sentiment toward crypto assets, as evidenced by on‑chain activity and exchange flows.
• Whale activity and smart‑money positioning for Bitcoin and Ether to gauge whether accumulation or unwind is prevailing.
• Policy updates related to tax refunds and federal spending to assess how fiscal changes influence liquidity dynamics.
• Market reactions in retail‑oriented platforms and names tied to high retail engagement, reflecting the broader risk‑on environment.

Raising capital is no longer the hardest part of building a blockchain project. Sustaining value after launch is. Today, many Web3 founders enter fundraising with strong technology, passionate teams, and promising roadmaps. Yet, within months of launching, their tokens lose momentum, investor confidence declines, and communities disengage. The problem is rarely the idea. It is usually the economic structure behind it.

Without clear token utility, disciplined emissions, and governance alignment, even well-funded projects struggle to survive volatile market cycles. This is why working with a proven ICO development company has become a strategic necessity rather than an optional choice. This guide is designed for serious founders, protocol teams, and enterprises who want to build scalable, investor-ready ecosystems. You will learn how sustainable tokenomics, structured governance, and professional execution can transform your ICO into a long-term growth engine.

Why Well-Funded ICOs Still Collapse After Launch

Many founders assume that once funding is secured, success will naturally follow. In reality, funding only creates opportunity. Execution determines survival. Capital can amplify progress, but it can also accelerate structural weaknesses if the foundation is not carefully designed. Even well-funded projects can unravel faster than undercapitalized ones, without a disciplined economic model and operational clarity. 

Some of the most common reasons ICOs fail after raising capital include:

• Excessive token inflation that dilutes value
• Weak or unclear utility models
• Overgenerous early investor allocations
• Lack of post-launch engagement strategy
• Poor liquidity planning
• Absence of governance frameworks

When these issues combine, selling pressure increases while demand stagnates. The result is a rapid decline in market confidence. Investor sentiment shifts quickly, liquidity dries up, and community morale weakens. Founders then spend most of their time firefighting instead of building. A strong launch must be engineered with sustainability in mind from day one. 

How Weak Token Economics Destroys Long-Term Project Value

When token supply grows faster than real usage, price erosion becomes inevitable. When rewards are misaligned, participants exploit incentives instead of contributing value. When governance lacks structure, disputes paralyze development. Sustainable ICO development requires deep modeling of how tokens will circulate, accumulate value, and support growth over time. It is about aligning user behavior with network success.

Projects that ignore this reality often experience:

• Rapid investor exits
• Exchange delistings
• Reduced partnership interest
• Difficulty raising follow-on capital
• Long-term brand damage

Once trust is lost, rebuilding it is extremely costly.

What VCs & Strategic Investors Look for Before Backing an ICO

Institutional investors no longer invest based on whitepapers alone. They evaluate token launches using rigorous frameworks. Before committing capital, most professional investors examine:

Is the token essential to the ecosystem, or is it optional? 

Tokens without core utility struggle to maintain demand. Investors look for clear, recurring use cases that generate consistent transactional activity and long-term relevance.

Are supply releases predictable and disciplined? 

Uncontrolled inflation signals high risk. Well-structured emission schedules demonstrate financial discipline and protect early participants from excessive dilution.

Do founders and early backers have long-term lockups? 

Short vesting often leads to early dumping. Extended vesting periods signal commitment and align leadership incentives with ecosystem growth.

Is there a clear plan for managing raised funds? 

Poor treasury strategy weakens sustainability. Institutional backers expect transparent budgeting, reserve planning, and responsible capital deployment.

Do token holders have meaningful participation? 

Governance builds long-term engagement. Clear voting systems and proposal mechanisms help prevent internal conflicts and promote community ownership.

Are security audits, compliance planning, and contingency strategies in place? 

Strong risk management reduces operational uncertainty and protects both users and investors from avoidable losses.

Projects that satisfy these criteria attract stronger capital and long-term partners.

The Six Pillars of Scalable ICO Development Architecture

1. Supply and Emission Control: Supply schedules must balance incentives and scarcity. Gradual emissions encourage participation without creating excessive selling pressure. Effective ICO development involves testing multiple scenarios to maintain stability across growth phases.
2. Utility Driven Demand: Tokens must provide real access, functionality, or economic benefits. Utility should be embedded into core product operations, as artificial demand rarely sustains long-term engagement.
3. Governance and Voting Rights: Transparent governance systems strengthen community trust and reduce centralization risk. Clear voting processes support sustainable decision-making.
4. Treasury and Reserve Design: Capital allocation must support development, security, and operations for multiple years. Reliable ICO development services help structure treasuries for long-term financial discipline.
5. Vesting and Lockups: Well-designed vesting protects against short-term speculation and reinforces long-term commitment from founders and early investors.
6. Liquidity Strategy: Liquidity planning is essential to stabilize early trading and manage volatility through exchange partnerships and market-making support.

When these pillars work together, ecosystems remain resilient under pressure and are positioned for sustainable growth.

Why Strategic Development Partners Matter in High-Stakes ICO Launches

Building a compliant, secure, and scalable token ecosystem requires expertise across economics, technology, regulation, and community development. Professional ICO development services extend far beyond basic smart contract deployment by integrating multiple strategic functions into a unified launch framework. Experienced partners support founders by helping them:

• Identify economic vulnerabilities before they impact token stability
• Optimize token distribution and incentive structures for long-term sustainability
• Prepare institutional-grade technical, legal, and compliance documentation
• Coordinate comprehensive security audits and regulatory reviews
• Design transparent and scalable post-launch governance systems
• Enable long-term platform performance and infrastructure growth

This integrated approach minimizes execution risk, strengthens investor confidence, and supports sustainable ecosystem expansion.

Critical ICO Mistakes Even Experienced Founders Make

Common pitfalls in ICO development include:

• Copying popular token models without customization
• Underestimating liquidity requirements
• Ignoring regulatory exposure
• Overpromising roadmap milestones
• Delaying governance implementation
• Prioritizing hype over infrastructure

Avoiding these errors requires disciplined planning, experienced oversight, and regular external review.

Are You Ready for a High-Impact ICO Launch

The difference between a short-lived token launch and a scalable digital economy lies in preparation, structure, and execution. Serious founders understand that sustainable growth does not happen by chance. It is engineered through disciplined planning, economic modeling, compliance clarity, and technical precision. If you are raising capital, preparing for exchange listings, or designing tokenomics for long-term value, now is the moment to make strategic decisions. The right partner can help you identify blind spots, strengthen investor confidence, and protect your ecosystem from avoidable risk.

Antier brings deep expertise in end-to-end ICO development, combining tokenomics strategy, regulatory alignment, smart contract security, and ecosystem architecture into a unified execution framework. Our team works alongside funded founders and Web3 innovators to design investor-ready systems that are built to scale. If you are serious about launching a resilient and institutionally credible token ecosystem, let us evaluate your readiness and design a strategy tailored to your vision.

US tax filers may see bigger refunds in 2026 compared with previous years, a development one Wall Street strategist said may boost risk appetite for digital assets and tech stocks preferred among retail investors.

In a note cited by CNBC, Wells Fargo analyst Ohsung Kwon said the coming refund wave may help bring back the so-called “YOLO” trade, with as much as $150 billion potentially flowing into equities and Bitcoin (BTC) by the end of March. Kwon said the extra cash could be most visible among higher-income consumers.

“Speculation picks up with bigger savings…we expect YOLO to return,” wrote Wells Fargo analyst Ohsung Kwon in a Sunday note seen by news outlet CNBC. “Additional savings from tax returns, especially for the high-income consumer will flow back into equities, in our view,” he added.

Kwon said some of that liquidity could move into Bitcoin and into stocks popular with retail traders, including Robinhood and Boeing.

Cointelegraph contacted Wells Fargo for details on the assumptions behind the $150 billion estimate and how much of that total the bank expects could go to digital assets, but had not received a response by publication time.

Bitcoin demand depends on sentiment

While some of the taxpayer funds may flow into Bitcoin and digital assets, it’s important to consider the higher inflation and consumer spending compared to the period during the COVID-19 pandemic, Nicolai Sondergaard, research analyst at crypto intelligence platform Nansen, told Cointelegraph:

“If sentiment starts to come around and retail sees positive upwards momentum in crypto assets, I see that as increasing the likelihood of funds flowing in this direction.”

Conversely, retail investors may opt for other assets with “higher momentum and social stickiness,” if digital asset sentiment doesn’t improve in the near term, he said.

The larger tax returns are due to the passage of US President Donald Trump’s One Big Beautiful Bill, which included numerous favorable provisions for 2025 tax filings.

Trump signed the One Big Beautiful Bill Act into law on July 4, 2025, saying it would cut as much as $1.6 trillion in federal spending.

Related: BlackRock enters DeFi as institutional crypto push accelerates: Finance Redefined

Smart money bets on crypto market downside as whales quietly accumulate

Meanwhile, the whales, or large investors, continue their quiet spot accumulation of the leading cryptocurrencies, while the most profitable traders by returns, tracked as “smart money,” are betting on more crypto market downside.

Smart money traders were net short on Bitcoin for a cumulative $107 million, along with most of the leading cryptocurrencies excluding Avalanche (AVAX), according to crypto intelligence platform Nansen.

Related: Binance completes $1B Bitcoin conversion for SAFU emergency fund

Still, whales acquired over $41.9 million worth of spot Ether (ETH) tokens across 22 wallets during the past week, marking a 1.7-fold increase in the spot purchases of this cohort.

Magazine: Bitcoin’s ‘biggest bull catalyst’ would be Saylor’s liquidation — Santiment founder