Android Security & Malware

[slides] OffensiveCon 2026: Tile-Based Deferred Rooting: When Your GPU Starts Rendering To Kernel Code Space! (CVE-2025-25180)
https://androidoffsec.withgoogle.com/slides/art_imagination_gpu_offensivecon_2026.pdf

👍28🔥19

9.22K views07:16

Android reverse engineering entirely on-device. Radare2 binary analysis, 8 Java decompilers, Flutter & Unity il2cpp support
https://github.com/UltraSina/androidReverse

GitHub

GitHub - UltraSina/androidReverse: Android reverse engineering entirely on-device. Radare2 binary analysis, 8 Java decompilers…

Android reverse engineering entirely on-device. Radare2 binary analysis, 8 Java decompilers, Flutter & Unity il2cpp support. - UltraSina/androidReverse

⚡15👎12🔥11👍9🤣8💩6

8.47K views07:27

Android Security & Malware

Android Malware Disguised as Document Reader Reaches 100K Downloads on Google Play | Anatsa banker
https://x.com/Threatlabz/status/2069190345418854810

X (formerly Twitter)

Zscaler ThreatLabz (@Threatlabz) on X

⚠️ ThreatLabz discovered another fake document reader in the Google Play Store with more than 100K downloads, which delivers the Anatsa Android trojan.

Anatsa installer MD5 hash: f72b1a333fa28b133df6476561142d6a
Payload URL: http://66.206.6[.]6:8080/disclaimer.txt…

❤35

8.15K views06:39

Android Security & Malware

1:00

This media is not supported in your browser

VIEW IN TELEGRAM

Android 17 root: full chain browser-to-kernel exploit with two 0-day vulnerabilities affecting Firefox before v151.0.2 (CVE-2026-10702)
Click on the link -> root Android
https://x.com/nebusecurity/status/2069707520160227688

🔥54😱28❤13🤔8😎7👀6👏4

14.4K views06:59

Android Security & Malware

Glitch SPY: New Android RAT Distributed Through a Fake Polish Rental App
https://cyble.com/blog/glitch-spy-rat-distributed-via-fake-polish-app/

Cyble

Glitch SPY RAT Distributed Via Fake Polish Rental App

CRIL analyzes Glitch SPY, an Android RAT with 70+ commands, crypto-clipping, and a silent remote browser, giving attackers full device control.

8.25K views08:37

Android Security & Malware

RedWing: A Mobile Malware-as-a-Service Operation
https://zimperium.com/blog/redwing-a-mobile-malware-as-a-service-operation

Zimperium

RedWing: A Mobile Malware-as-a-Service Operation

true

👍25⚡15👏13❤9

5.9K views06:23

Android Security & Malware

GoldPickaxe Returns: When Your Biometric Information is as Important as Your Money
https://zimperium.com/blog/goldpickaxe-returns-when-your-biometric-information-is-as-important-as-your-money

Zimperium

GoldPickaxe Returns: When Your Biometric Information is as Important as Your Money

true

👍19🎃12❤7

5.09K views11:06

Android Security & Malware

How to Bypass mTLS on Android with Frida
https://kiratliygt.medium.com/how-to-bypass-mtls-on-android-with-frida-45c5e71373e8

Medium

How to Bypass mTLS on Android with Frida

Keywords: mTLS bypass Android, Frida mTLS, Android mutual TLS bypass, Burp Suite mTLS Android, Android mTLS pentest, PKCS12 Android…

👍30❤19

5.36K views06:14

Android Security & Malware

RedHook Android malware abuses ADB Wireless Debugging and Shizuku to get shell-level privileges
https://www.group-ib.com/blog/redhook-android-rat-upgraded/

Group-IB

RedHook Returns with a Dangerous Upgrade

Group-IB analysts examine this resurfaced Android Remote Access Trojan, demonstrating new, sophisticated and malicious functionalities including autonomous privilege abuse, expanded command-and-control capabilities, and a robust persistence stack.

👍14👎13🤡10❤6🔥5😁4

4.87K views13:34

Android Security & Malware

Forwarded from The Bug Bounty Hunter

Reading Contact Photos Without READ_CONTACTS: A Google Messages Confused Deputy Bug

https://blog.devploit.dev/posts/google-messages-avatarcontentprovider-contacts-bypass/

devploit / blog

Reading Contact Photos Without READ_CONTACTS: A Google Messages Confused Deputy Bug

What happens if an app without READ_CONTACTS asks Google Messages for Android to load a Contacts photo for it?

❤34