Android Security & Malware

Android 17 root: full chain browser-to-kernel exploit with two 0-day vulnerabilities affecting Firefox before v151.0.2 (CVE-2026-10702)
Click on the link -> root Android
https://x.com/nebusecurity/status/2069707520160227688

🔥55😱29❤13🤔8😎7👀6👏5

15.1K views06:59

Glitch SPY: New Android RAT Distributed Through a Fake Polish Rental App
https://cyble.com/blog/glitch-spy-rat-distributed-via-fake-polish-app/

Cyble

Glitch SPY RAT Distributed Via Fake Polish Rental App

CRIL analyzes Glitch SPY, an Android RAT with 70+ commands, crypto-clipping, and a silent remote browser, giving attackers full device control.

8.99K views08:37

Android Security & Malware

RedWing: A Mobile Malware-as-a-Service Operation
https://zimperium.com/blog/redwing-a-mobile-malware-as-a-service-operation

Zimperium

RedWing: A Mobile Malware-as-a-Service Operation

true

👍28⚡19👏16❤10

6.72K views06:23

Android Security & Malware

GoldPickaxe Returns: When Your Biometric Information is as Important as Your Money
https://zimperium.com/blog/goldpickaxe-returns-when-your-biometric-information-is-as-important-as-your-money

Zimperium

GoldPickaxe Returns: When Your Biometric Information is as Important as Your Money

true

👍22🎃13❤9

5.92K views11:06

Android Security & Malware

How to Bypass mTLS on Android with Frida
https://kiratliygt.medium.com/how-to-bypass-mtls-on-android-with-frida-45c5e71373e8

Medium

How to Bypass mTLS on Android with Frida

Keywords: mTLS bypass Android, Frida mTLS, Android mutual TLS bypass, Burp Suite mTLS Android, Android mTLS pentest, PKCS12 Android…

👍35❤23

6.33K views06:14

Android Security & Malware

RedHook Android malware abuses ADB Wireless Debugging and Shizuku to get shell-level privileges
https://www.group-ib.com/blog/redhook-android-rat-upgraded/

Group-IB

RedHook Returns with a Dangerous Upgrade

Group-IB analysts examine this resurfaced Android Remote Access Trojan, demonstrating new, sophisticated and malicious functionalities including autonomous privilege abuse, expanded command-and-control capabilities, and a robust persistence stack.

👍18👎14🤡9❤8🔥6😁5

6.49K views13:34

Android Security & Malware

Forwarded from The Bug Bounty Hunter

Reading Contact Photos Without READ_CONTACTS: A Google Messages Confused Deputy Bug

https://blog.devploit.dev/posts/google-messages-avatarcontentprovider-contacts-bypass/

devploit / blog

Reading Contact Photos Without READ_CONTACTS: A Google Messages Confused Deputy Bug

What happens if an app without READ_CONTACTS asks Google Messages for Android to load a Contacts photo for it?

❤34👍7