SUPPLY CHAIN ATTACK EMBEDS MALWARE IN ANDROID DEVICES

Summary from the TLDR InfoSec newsletter

Keenadu is a firmware-level Android malware embedded via supply chain compromise that hijacks Android's Zygote process to inject itself into every app on infected devices. It affects 13,000 devices across Russia, Japan, Germany, Brazil, and the Netherlands. Operating as a multistage loader, Keenadu deploys modules targeting shopping platforms such as Amazon and Temu, monitors Chrome queries, and commits ad fraud. Organizations should cross-reference Kaspersky's published IoCs against managed Android fleets. Firmware-level infections require full firmware replacement, and system app infections are mitigated by disabling or replacing the compromised app.