Previous posts: Basic definitions and registers, lab setup, offset and addressing modes, Load And Store, Branch

Introduction

The messaging app left a huge database of unencrypted private messages online but without a password for months.

Previous posts: Basic definitions and registers, lab setup, offset and addressing modes, Load And Store, Branch, Data Processing Part 1

Threat actors are constantly using new tricks and tactics to target users across the globe. This blog is about SpyNote,  […]

A deep dive into an in-the-wild Android exploit Guest Post by Xingyu Jin, Android Security Research This is part one of a two-part guest...

SOVA, a new Android Banking Trojan, is spreading across Europe. Already appeared in different versions, this malware is now evolving, and it is targeting more than 200 mobile applications, ranging from banking apps to crypto exchanges/wallets. Here's the…

Following our presentation at Black Hat USA, in this blog post we provide some details on CVE-2022-20233, the latest vulnerability we found on Titan M, and how we exploited it to obtain code execution on the chip.

In Q2 2022, we detected 405,684 mobile malware installation packages, of which 55,614 packages were related to mobile banking trojans, and 3,821 packages were mobile ransomware trojans.

So far we went trough the most important instructions of the AArch64 instruction set and it is time to move to something more practical. In…

During a Digital Forensics investigation, ZecOps made an interesting finding: a cheap burner device that purported to be an Android 10 was actually an old Android 6. In the first part of the series, we presented how attackers can ‘fake’ the shutdown screen…

Analysis of the group behind Xenomorph and Gymdrop

Researchers at Checkmarx found that the Ring Android app could have allowed a malicious application installed on the user’s phone to expose their personal data, geolocation, and camera recordings.

Note: all applications mentioned in this research have been taken down and are
no longer accessible.

This post explains how to bypass TLS verification on Flutter apps, including bypassing Dio Pinning.

Technical analysis of the MoqHao (a.k.a RoamingMantis) Android malware and phishing campaign

A collection of interesting and diverse Android malware samples