Tag: android
119 articles
Anthropic Warns of Self-Replicating AI Worms in IoT Devices
Imagine a computer worm that can replicate itself across millions of devices, making it nearly impossible to shut down - and Anthropic is warning us that this AI nightmare is more possible than we think. The AI research company has demonstrated that a large language model can be distributed across cheap Android devices, like streaming boxes, to perform tasks at a surprisingly slow but functional rate.
RatHat Malware Evolves with AI-Powered Command Center
RatHat Malware is rapidly evolving with an AI-powered command center, having undergone three major command-and-control infrastructure updates in just six months, with nearly 100 deployments since April 2026. This malware-as-a-service model is getting smarter and more aggressive by the day.
File Notification Flaws Expose System Data Across Major Operating Systems
Major operating systems, including Linux, Android, Windows, and macOS, are vulnerable to file notification flaws that can expose sensitive system data, thanks to decades-old bugs in their file-notification subsystems. These flaws can leak timing and path information about file activity, putting users at risk.
Researchers Build WeChat Worm Hijacking Phones via Zero-Click Calls
Meet WeWorm, a powerful tool that can hijack WeChat accounts and take control of phones with just a single, zero-click call - and experts warn that AI has made building such threats faster and more accessible than ever. This alarming innovation can give attackers full control to read and send messages, make calls, and act on a victim's behalf.
Gigabud Malware Exploits Android App Cloning to Evade Detection
Malware attackers have found a sneaky way to evade detection by cloning legitimate Android apps, with a recent campaign racking up an estimated $960,939 in losses across 1,469 compromised devices in Indonesia. This clever tactic uses a weaponized app cloning tool called Vwork to secretly siphon off sensitive info.
WeChat Zero-Click Flaw Exploited to Hijack Accounts via Incoming Calls
A security firm, Calif, has successfully demonstrated a zero-click worm that can hijack WeChat accounts on both iPhone and Android devices with just an incoming call, and fortunately, the exploit has been blocked for all users. This alarming vulnerability was responsibly disclosed to Tencent in July, putting an end to the threat.
ToxicPanda Malware Exploits VPN Permissions to Evade Google Play Security Checks
Meet ToxicPanda, a sneaky malware that's evolved to outsmart Google Play's security checks by exploiting VPN permissions and controlling device traffic. This cunning threat can now target nearly 350 apps and execute over 160 remote commands, putting your mobile security at risk.
Kimwolf Botnet Evolves with Enhanced DDoS Capabilities
Meet Kimwolf v7, a highly evolved botnet that's taken DDoS capabilities to the next level with its cutting-edge command-and-control resolution via Ethereum's blockchain naming system, ENS. First discovered in February 2026, this malware has been quietly building its arsenal since August 2024, targeting a range of devices from Linux IoT gadgets to Android TV boxes.
Mobile Malware Attacks Decline, Banking Trojans Persist
Mobile malware attacks may be on the decline, but don't let your guard down - over 1.99 million mobile devices were still threatened by malware, adware, or unwanted software in the second quarter alone. Banking Trojans, in particular, remain a persistent threat, with over 93,000 malicious packages detected.
Cybercriminals Exploit AI Safety Controls with Task-Splitting Technique
Cybercriminals are outsmarting AI safety controls with a clever task-splitting technique, allowing them to assemble malicious tools like DDoS software with ease. By breaking down bad code into tiny, harmless pieces, they're slipping past guardrails and wreaking havoc - as seen in a recent attack that took control of nearly 2,000 Android TVs.
BTMOB Malware Ecosystem Fractures as Resellers Exploit Source Code
The BTMOB malware ecosystem has shattered into a patchwork of fragmented offerings, morphing from a single, centrally operated service to a chaotic mix of official releases, private servers, and reseller panels. This dramatic shift comes after the source code was exploited, sending the once-coordinated operation into a tailspin.
Invisible Screen Text Exposes Android AI Agents to Code Injection Attacks
Researchers found that a simple payload could launch a code injection attack on four open-source Android agent frameworks, successfully executing commands on the host's system in every trial. This alarming vulnerability allows attackers to exploit AI agents by manipulating text on the screen, turning a harmless string into a malicious command.
EU Orders Google to Open Android to Rival AI Assistants
Google is now required to open up Android to rival AI assistants, a move the company claims could compromise device security by giving external apps sensitive permissions. The European Commission's order, made under the Digital Markets Act, forces Google to grant third-party AI assistants access to Android sensors and system features.
RedWing Malware Targets Android Users with Bank Fraud as a Service
A new, ready-to-use bank-fraud tool called RedWing is being rented on Telegram, allowing even novice criminals to hijack Android users' phones and steal their banking information. This malicious kit is sold as a complete package, complete with step-by-step guides and how-to videos, making it alarmingly easy for scammers to get started.
Linux Flaw Exposes Unprivileged Users to Root Access
A newly discovered Linux flaw, CVE-2026-46242, allows ordinary users to gain root access to a machine, and even Android devices are vulnerable. This alarming vulnerability, known as Bad Epoll, can be exploited with ease, but thankfully, a working fix is now available.
FBI and Google Disrupt NetNut Proxy Network Used by Cyber Threat Actors
In a major win for cybersecurity, the FBI and Google have joined forces to dismantle the notorious NetNut proxy network, a go-to tool for cyber threat actors. This disruption has significantly reduced the network's capacity, cutting the available pool of devices by millions.
EU Court Upholds $4.7 Billion Google Antitrust Fine
Google's last-ditch effort to overturn a $4.7 billion antitrust fine has been rejected by the EU's top court, affirming that the company's Android agreements did indeed stifle competition. The Court of Justice of the European Union dismissed Google's appeal, upholding the hefty penalty.
AirDrop and Quick Share Flaws Expose Devices to Local Attacks
Millions of devices are vulnerable to local attacks due to flaws in popular sharing services like AirDrop and Samsung Quick Share, discovered by researchers Arash Ale Ebrahim and Nils Ole Tippenhauer. They found six distinct flaws that can be exploited by nearby attackers to crash services or bypass security checks.
Google Tightens Android App Verification Rules Ahead of Sept. 30 Deadline
Get ready for a safer app experience on Android! As of September 30, 2026, Google will start enforcing developer verification, blocking installs of unverified apps on certified phones in Brazil, Indonesia, Singapore, and Thailand.
Microsoft 365 Android Apps Expose Account Tokens Due to Debug Flag Oversight
A single line of code, "setIsDebugMode(true)," inadvertently left in multiple Microsoft 365 Android apps, created a gaping security hole that allowed other apps on the same phone to access sensitive account tokens without user permission. This tiny oversight, discovered by Enclave's Yanir Tsarimi and Ofek Levin, exposed users to potential security risks.
Google patches actively exploited Android zero-day flaw amid June security updates
Google just patched a high-severity Android flaw that's being actively exploited by hackers, allowing them to gain control of devices running Android 14 or later. The June security update fixes this zero-day vulnerability, along with 123 others, to keep your device safe.
Malware Campaigns Target Windows, Android Users in Global Finance Sector
Global finance sector faces a double threat as malware campaigns target Windows and Android users, with attackers using clever tactics like hiding in trusted traffic and selling mobile RATs as turnkey services. Two recent campaigns, one using Grandoreiro malware in Portugal, Spain, and Mexico, and another using a new BTMOB trojan in Brazil, highlight the evolving threat landscape.
Canada Arrests Suspect Tied to Kimwolf Botnet Operation
In a major breakthrough, Canadian authorities have arrested 23-year-old Jacob Butler, aka "Dort", for his alleged role as a key administrator of the notorious Kimwolf botnet operation, which infected over 2 million Android TV devices worldwide. The arrest marks a significant step in the fight against one of the most widespread distributed-denial-of-service (DDoS) botnets on record.
Google and Apple Roll Out Cross-Platform RCS Encryption
Big news for messaging security: Apple and Google have just launched a beta rollout of end-to-end encrypted RCS messaging, allowing for more secure conversations between iPhone and Android users worldwide. This update enables encryption by default, marked with a lock icon, and is available to users with supported carriers and devices.