In late February 2026, SophosLabs identified the Keenadu backdoor affecting Android devices, which is embedded in the libandroid_runtime.so library. This firmware-level malware injects itself into the Zygote process,…
2 articles · Updated March 19, 2026
Recent Intelligence Reports
Android devices ship with firmware-level malware— Sophos · March 19, 2026