Analysing a Pegasus 0-click Exploit for iOS
Recreated the "Blastpass" iOS exploit in a faked target process, to understand the heap shaping strategy first-hand
https://youtu.be/0JFcDCW3Sis
Recreated the "Blastpass" iOS exploit in a faked target process, to understand the heap shaping strategy first-hand
https://youtu.be/0JFcDCW3Sis
YouTube
Analysing a Pegasus 0-click Exploit for iOS
Are you a security researcher or reverse engineer?
For 50% off IDA Products use promo code BILLY50, https://hex-rays.com/pricing *
For 30% off IDA Training use promo code BILLY30, https://hex-rays.com/training **
*License discounts are only valid for individualsโฆ
For 50% off IDA Products use promo code BILLY50, https://hex-rays.com/pricing *
For 30% off IDA Training use promo code BILLY30, https://hex-rays.com/training **
*License discounts are only valid for individualsโฆ
๐15โค8
Deep-C: Android Deep Link misconfiguration detector and exploitation tool
https://github.com/KishorBal/deep-C
https://github.com/KishorBal/deep-C
๐ฅ15โค8๐3๐2
Practical Mobile Traffic Interception
https://medium.com/@justmobilesec/practical-mobile-traffic-interception-1481e33d974e
https://medium.com/@justmobilesec/practical-mobile-traffic-interception-1481e33d974e
Medium
Practical Mobile Traffic Interception
TL;DR#1: The post will discuss a step-by-step guide of how mobile web traffic can be intercepted on current android and ios applicationsโฆ
๐16
Sapsan Terminal: new AIโpowered HID scripting tool that speeds up payload creation and handles the syntax for 15 supported devices (video test)
https://www.mobile-hacker.com/2026/02/03/sapsan-terminal-ai-powered-badusb-script-generator/
https://www.mobile-hacker.com/2026/02/03/sapsan-terminal-ai-powered-badusb-script-generator/
Mobile Hacker
Sapsan Terminal: AI-Powered BadUSB Script Generator - Mobile Hacker
Cybersecurity professionals and enthusiasts often rely on scripting to automate tasks and execute penetration tests efficiently. Writing payloads manually for devices like Rubber Ducky, Evil Crow Cable, or Flipper Zero can be time-consuming and error-prone.โฆ
๐10๐3โค1๐ค1
FIRST Ever Online Mobile Hacking Conference
Free, worldwide online event bringing the mobile security community together for sessions on mobile hacking, AI, malware, forensics, live mobileโfocused CTF with prizes!
When: March 3 and 4, 2026
Register here: https://www.mobilehackinglab.com/mobile-hacking-conference-registration
Free, worldwide online event bringing the mobile security community together for sessions on mobile hacking, AI, malware, forensics, live mobileโfocused CTF with prizes!
When: March 3 and 4, 2026
Register here: https://www.mobilehackinglab.com/mobile-hacking-conference-registration
๐16
Inside a Multi-Stage Android Malware Campaign Leveraging RTO-Themed Social Engineering
https://www.seqrite.com/blog/inside-a-multi-stage-android-malware-campaign-leveraging-rto-themed-social-engineering/
https://www.seqrite.com/blog/inside-a-multi-stage-android-malware-campaign-leveraging-rto-themed-social-engineering/
Blogs on Information Technology, Network & Cybersecurity | Seqrite
Inside a Multi-Stage Android Malware Campaign Leveraging RTO-Themed Social Engineering
<p>In recent years, Android malware campaigns in India have increasingly abused the trust associated with government services and official digital platforms. By imitating well-known portals and leveraging social engineering through messaging applicationsโฆ
๐11โค5
MobSF has Stored XSS via Manifest Analysis of uploaded APK (CVE-2026-24490 )
https://github.com/advisories/GHSA-8hf7-h89p-3pqj
https://github.com/advisories/GHSA-8hf7-h89p-3pqj
๐39โค1๐คช1
Understanding and Experimenting with Apple's Pointer Authentication Codes (PAC) on iOS
https://blog.reversesociety.co/blog/2026/pointer-authentication-code-for-ios
https://blog.reversesociety.co/blog/2026/pointer-authentication-code-for-ios
๐11๐3
Android Dynamic Class Dumper โ dump all DEX files from running Android apps using Frida
https://github.com/TheQmaks/clsdumper
https://github.com/TheQmaks/clsdumper
GitHub
GitHub - TheQmaks/clsdumper: Android Dynamic Class Dumper โ dump all DEX files from running Android apps using Frida
Android Dynamic Class Dumper โ dump all DEX files from running Android apps using Frida - TheQmaks/clsdumper
โค14๐5๐ฉ4๐1๐1
IPATool: command line tool that allows to download iOS apps on the App Store
https://github.com/majd/ipatool
https://github.com/majd/ipatool
GitHub
GitHub - majd/ipatool: Command-line tool that allows searching and downloading app packages (known as ipa files) from the iOS Appโฆ
Command-line tool that allows searching and downloading app packages (known as ipa files) from the iOS App Store - majd/ipatool
โค19๐ฅ5๐คฎ3๐ฉ1
How to install OpenClaw on Android and control it via WhatsApp using automated script
Blog: https://www.mobile-hacker.com/2026/02/11/how-to-install-openclaw-on-an-android-phone-and-control-it-via-whatsapp/
Installer script: https://github.com/androidmalware/OpenClaw_Termux
Blog: https://www.mobile-hacker.com/2026/02/11/how-to-install-openclaw-on-an-android-phone-and-control-it-via-whatsapp/
Installer script: https://github.com/androidmalware/OpenClaw_Termux
GitHub
GitHub - androidmalware/OpenClaw_Termux: How to Install OpenClaw on an Android Phone and Control It via WhatsApp
How to Install OpenClaw on an Android Phone and Control It via WhatsApp - androidmalware/OpenClaw_Termux
๐ฅด10๐6๐3๐ฉ2๐คฃ2โค1
Intro to Android WebViews and deep linksโฆand how to exploit them
https://djini.ai/intro-to-android-webviews-and-deep-links-and-how-to-exploit-them/
https://djini.ai/intro-to-android-webviews-and-deep-links-and-how-to-exploit-them/
Djini.ai
Intro to Android WebViews and deep links...and how to exploit them - Djini.ai
Android WebView is a system component that allows applications to render web content directly inside a native app, and it is one of the most widely used building blocks in the Android ecosystem. At the same time, deep links have become the primary way appsโฆ
๐18โค4๐1