Free Android Application APK & API Vulnerability Scanner tool. Available for Windows & Mac. Get the android app security scanner.

What’s the deal with iOS security updates, anyway?

Frida Android utilities. Contribute to Hamz-a/frida-android-helper development by creating an account on GitHub.

During my preparation for eMAPT, I came across Mobile Hacking Lab  — and their free hacking labs which I felt would help me for practice…

kfd, short for kernel file descriptor, is a project to read and write kernel memory on Apple devices. - felix-pb/kfd

MyEstatePoint Property Search Android app leaks user passwords.

Introduction

Drawing attention to the ways threat actors steal PII for financial fraud, this article focuses on a malicious APK campaign aimed at Chinese users.

GrapheneOS, a privacy and security-focused Android-based operating system, has posted a series of tweets on X suggesting that Android should introduce frequent auto-reboots to make it harder for forensic software vendors to exploit firmware flaws and spy…

A PoC that exploits a vulnerability to bypass the Xiaomi HyperOS community restrictions of BootLoader unlocked account bindings. - MlgmXyysd/Xiaomi-HyperOS-BootLoader-Bypass

In a recent engagement I had to deal with some custom encrypted strings inside an Android ARM64 app. I had a lot of fun reversing the app and in the process I learned a few cool new techniques whic…

Analyzing Shutdown.log file as a lightweight method to detect indicators of infection with sophisticated iOS malware such as Pegasus, Reign and Predator.

A lab that covers XSS in a WebView within Android which could be exploited by other apps in the device, combined with a Command Injection…

Background


Some time ago, we intercepted a dubious ELF sample exhibiting zero detection on VirusTotal. This sample, named pandoraspear and employing a modified UPX shell, has an MD5 signature of 9a1a6d484297a4e5d6249253f216ed69. Our analysis revealed that…

More recently, the cybersecurity community has seen numerous studies of supply chain attacks on Web apps.

Introduction:

This is a version of our report referenced in the Helping a mobile malware fraud victim blog post, with all sensitive information removed. Summary One malicious application was identified on the device, and evidence identified during the examination strong…

[update 2024-02-19] This vulnerability can be even used to remotely wipe data of targeted Android smartphone. Using this vulnerability it is possible to guess user lock screen PIN. After five incorrect PINs device is locked out for 30 seconds. This operation…