Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.

From a fake N26 support call to the Copybara Android RAT: inside a human-operated phishing campaign designed for on-device financial fraud.

Jailbreak supported Google Pixel phones with CVE-2026-43499 - alex193a/Root-My-Pixel

Unlike traditional Android Remote Access Trojan (RAT), Android Octagon employs a multi-stage design that dynamically loads encrypted DEX and JAR […]

Bitsight's TRACE team exposes the "Fuyao Enterprise," a hidden Android TV botnet using 120,000+ AI digital humans to power large-scale ad fraud. Learn more.

An attacker within Bluetooth LE range (about 50 m) can write arbitrary files to a victim’s phone the moment they open Receive mode. No QR scan

tl;dr I built an agentic mobile security research system that runs the whole mobile bug bounty pipeline, from scoping a program to writing the report. Here is what happened when I pointed it at real programs.

Dropping Elephant, also called Patchwork, is an espionage APT active since 2015. Review its MITRE ATT&CK techniques and validate your controls.

An EFF investigation identified several advertising software development kits (SDKs) that publicly acknowledge collecting and sharing users’ location by default when embedded in apps granted location

IBM Trusteer's in-depth analysis of GoldDigger malware reveals how this sophisticated Android mobile banking Trojan uses virtual environments and evasion techniques. Learn to recognize the threat and protect yourself from bad actors.

Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing.

Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst's…

LLM Obfuscation Detection Framework for Android Apps - Mobile-IoT-Security-Lab/LLMObfuscDetection

LSPosed module for disabling SSL certificate pinning on Android. Covers Java-layer pinning (OkHttp, TrustManager, Conscrypt, WebView, Cordova, Tencent X5) and native-layer pinning (BoringSSL embedd...

A previously undocumented Android on-device fraud bot, advertised as malware-as-a-service since June 2026, with overlays for crypto wallets and banking apps.