Contactless cards and key fobs are now part of everyday life. They unlock apartment buildings, identify employees, open hotel rooms, record attendance and interact with electronic locks. Although many of these credentials look similar from the outside, the…

Black Box Dynamic Analysis Telegram Mini App Tool to detect Privacy Policy Violations - Mobile-IoT-Security-Lab/TeleGapper

The first zero-click worm to spread through WeChat calls across iOS and Android.

How the Gigabud Android banking trojan abuses Shelter, an open-source app cloner, and what that means for banks, users, and defenders.

true

true

Do you have an older rooted Android phone sitting unused in a drawer? Instead of leaving it there, you can turn it into a practical NFC reader and USB keyboard for your computer. With a custom Android app (NFC to HID), your phone can read the unique indentation…

Chaining an AtlasService binder command injection and an olc2 HAL binder method into uid 0 with all Linux capabilities from a plain installable app on OxygenOS 16.

Group-IB uncovers RemControl, a new Android banking trojan targeting European, Middle Eastern and Canadian banks, whose criminal infrastructure was unknowingly built by AI.

A native APK and DEX decompiler written in Rust. Contribute to Ch0pin/rdx development by creating an account on GitHub.

Suitable for Android APK reverse engineering analysis - newliver666/apk-reverse

Cleafy's TIR team analyzed the operator infrastructure behind RATHat, an Android banking trojan that abuses Accessibility Services to enable wireless debugging on the victim's phone, obtain a shell, and deploy a hidden native service outside the app. The…

A look at the targeted AI taskflows behind these findings, the bugs they uncovered, and how to run the same open-source agent on your own app.

CVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF — iOS/macOS kernel vulnerability leading to deferred panic (A19 Pro, iOS 26.3 RC) - 0xjohnnydev/CVE-2026-20687-AppleJPEGDriver-UAF