Android Security & Malware

NFCShare evolves: from a banking phishing APK to a GitHub-hosted Android NFC fraud campaign
https://www.d3lab.net/nfcshare-evolves-from-a-banking-phishing-apk-to-a-github-hosted-android-nfc-fraud-campaign/

D3Lab

NFCShare evolves: from a banking phishing APK to a GitHub-hosted Android NFC fraud campaign

A new NFCShare Android malware campaign distributed through an Intesa Sanpaolo-themed phishing flow, short URLs, and GitHub-hosted APKs. The recent samples keep the same NFC card-theft logic but introduce stronger anti-analysis packaging, brand rotation,…

👍27❤1

7.25K views20:11

Android Security & Malware

Tested the raw socket layer of a pre-production POS system. Found 4 critical/high vulnerabilities — including a replay attack, cross-merchant IDOR, ghost transactions, and card identity bypass
https://m4kr0.vercel.app/posts/iso-8583-under-fire-finding-vulnerabilities-in-a-payment-socket

M4KR0 Blog

ISO 8583 Under Fire: Finding Vulnerabilities in a Payment Socket - M4KR0 Blog

A hands-on walkthrough of security testing an ISO 8583 payment socket — from reversing the app and enabling hidden debug mode, to finding four critical vulnerabilities in the processor layer

🔥23❤22⚡18

8.18K views05:36

Android Security & Malware

FirefUXSS 0-day: Universal XSS in Firefox Focus for iOS via Redirect-Scheme Validation Race Condition - not patched yet
https://github.com/v12-security/pocs/tree/main/firefox

GitHub

pocs/firefox at main · v12-security/pocs

poc it like it's hot. Contribute to v12-security/pocs development by creating an account on GitHub.

❤20🔥14👍11

13.1K views19:59

Android Security & Malware

I tested Nearby Glasses app to detect "spy" smart glasses - I explained why it is not working reliably and how the app can be even spoofed with fake Bluetooth signals
https://www.mobile-hacker.com/2026/06/14/smart-glasses-can-record-you-and-detecting-them-isnt-so-simple/

Mobile Hacker

Smart Glasses Can Record You - And Detecting Them Isn’t So Simple - Mobile Hacker

Smart glasses with camera are becoming more common, fitting into everyday life. They look like normal sunglasses — but they can record video, capture audio, and take photos at any moment.

❤32👍18

7.79K views08:34

Android Security & Malware

Local Privilege Escalation (LPE) vulnerability in MEmu Android Emulator 9.2.7.0 (CVE-2026-36213)
https://github.com/sec-zone/CVE-2026-36213

GitHub

GitHub - sec-zone/CVE-2026-36213: CVE-2026-36213 | Local Privilege Escalation in MEmu Android Emulator 9.2.7.0 via Insecure Service…

CVE-2026-36213 | Local Privilege Escalation in MEmu Android Emulator 9.2.7.0 via Insecure Service Binary Permissions | Patched in 9.3.2 - sec-zone/CVE-2026-36213

❤26👍20

8.13K views06:30

Android Security & Malware

Rokarolla : Android Banker with Complete Device Takeover Capabilities
https://zimperium.com/blog/rokarolla-android-banker-with-complete-device-takeover-capabilities

Zimperium

Rokarolla : Android Banker with Complete Device Takeover Capabilities

true

👍31🔥21

8.82K views06:46

Android Security & Malware

[slides] OffensiveCon 2026: Tile-Based Deferred Rooting: When Your GPU Starts Rendering To Kernel Code Space! (CVE-2025-25180)
https://androidoffsec.withgoogle.com/slides/art_imagination_gpu_offensivecon_2026.pdf

👍30🔥19

9.34K views07:16

Android Security & Malware

Android reverse engineering entirely on-device. Radare2 binary analysis, 8 Java decompilers, Flutter & Unity il2cpp support
https://github.com/UltraSina/androidReverse

GitHub

GitHub - UltraSina/androidReverse: Android reverse engineering entirely on-device. Radare2 binary analysis, 8 Java decompilers…

Android reverse engineering entirely on-device. Radare2 binary analysis, 8 Java decompilers, Flutter & Unity il2cpp support. - UltraSina/androidReverse

⚡15👎14🔥11👍10🤣9💩5

8.63K views07:27

Android Security & Malware

Android Malware Disguised as Document Reader Reaches 100K Downloads on Google Play | Anatsa banker
https://x.com/Threatlabz/status/2069190345418854810

X (formerly Twitter)

Zscaler ThreatLabz (@Threatlabz) on X

⚠️ ThreatLabz discovered another fake document reader in the Google Play Store with more than 100K downloads, which delivers the Anatsa Android trojan.

Anatsa installer MD5 hash: f72b1a333fa28b133df6476561142d6a
Payload URL: http://66.206.6[.]6:8080/disclaimer.txt…

❤37

8.33K views06:39

Android Security & Malware

1:00

This media is not supported in your browser

VIEW IN TELEGRAM

Android 17 root: full chain browser-to-kernel exploit with two 0-day vulnerabilities affecting Firefox before v151.0.2 (CVE-2026-10702)
Click on the link -> root Android
https://x.com/nebusecurity/status/2069707520160227688

🔥55😱29❤13🤔8😎7👀6👏5

14.7K views06:59

Android Security & Malware

Glitch SPY: New Android RAT Distributed Through a Fake Polish Rental App
https://cyble.com/blog/glitch-spy-rat-distributed-via-fake-polish-app/

Cyble

Glitch SPY RAT Distributed Via Fake Polish Rental App

CRIL analyzes Glitch SPY, an Android RAT with 70+ commands, crypto-clipping, and a silent remote browser, giving attackers full device control.

8.55K views08:37

Android Security & Malware

RedWing: A Mobile Malware-as-a-Service Operation
https://zimperium.com/blog/redwing-a-mobile-malware-as-a-service-operation

Zimperium

RedWing: A Mobile Malware-as-a-Service Operation

true

👍26⚡16👏12❤9

6.15K views06:23

Android Security & Malware

GoldPickaxe Returns: When Your Biometric Information is as Important as Your Money
https://zimperium.com/blog/goldpickaxe-returns-when-your-biometric-information-is-as-important-as-your-money

Zimperium

GoldPickaxe Returns: When Your Biometric Information is as Important as Your Money

true

👍22🎃13❤9

5.38K views11:06

Android Security & Malware

How to Bypass mTLS on Android with Frida
https://kiratliygt.medium.com/how-to-bypass-mtls-on-android-with-frida-45c5e71373e8

Medium

How to Bypass mTLS on Android with Frida

Keywords: mTLS bypass Android, Frida mTLS, Android mutual TLS bypass, Burp Suite mTLS Android, Android mTLS pentest, PKCS12 Android…

👍32❤21

5.75K views06:14

Android Security & Malware

RedHook Android malware abuses ADB Wireless Debugging and Shizuku to get shell-level privileges
https://www.group-ib.com/blog/redhook-android-rat-upgraded/

Group-IB

RedHook Returns with a Dangerous Upgrade

Group-IB analysts examine this resurfaced Android Remote Access Trojan, demonstrating new, sophisticated and malicious functionalities including autonomous privilege abuse, expanded command-and-control capabilities, and a robust persistence stack.

👍17👎13🤡10❤6🔥5😁4

5.56K views13:34

Android Security & Malware

Forwarded from The Bug Bounty Hunter

Reading Contact Photos Without READ_CONTACTS: A Google Messages Confused Deputy Bug

https://blog.devploit.dev/posts/google-messages-avatarcontentprovider-contacts-bypass/

devploit / blog

Reading Contact Photos Without READ_CONTACTS: A Google Messages Confused Deputy Bug

What happens if an app without READ_CONTACTS asks Google Messages for Android to load a Contacts photo for it?

❤34👍2