‘Keenadu’ Firmware Backdoor Hijacks Android from the Inside Out

Sophos researchers detail Keenadu, a firmware-level Android backdoor embedded in libandroid_runtime.so that infects the Zygote process to persist in every app; it functions as a modular downloader for data-theft and ad-fraud modules targeting shopping and social apps and appears to have been integrated during firmware build, with observed C2 domains including proczone.com, goaimb.com, and aifacecloud.com.