Tag: mobile security
166 articles
Android Malware Mantax Otax Encrypts Devices, Steals Data, and Harasses Victims
Beware of Mantax Otax, a sneaky Android malware that's encrypting devices, swiping sensitive data, and even harassing victims - all thanks to clever tricks by Indonesian operators who are using sideloaded APKs to spread the threat.
Malicious Extensions Expose Crypto Data AI Agents Automate Cyber Intrusions Shadow AI Exposes Sensitive Data Fake M&A Deals Drive Wire Fraud 200 Android Flaws Patched 119K Domains Power Fake Shops Chrome Accelerates Security Releases Singpass Scheme Tied to 170 Victims Email Breach Fuels Wallet Phishing 33K+ Plex Servers Remain Exposed EtherRAT Chain Ends in Ransomware CISA Refreshes Insider Threat Guidance AI
Google just patched 200 security flaws in Android, including a critical Wi-Fi vulnerability that could let hackers take control of your device - and it's a stark reminder to stay vigilant about the risks lurking in ordinary access and trusted services.
Google Play Exposed to Deceptive App Abuse
A sneaky app, "Vice Streets: Open World", racked up over 1 million downloads on Google Play without a single public review or rating, taking advantage of the platform's Early Access feature. This feature, meant to help developers gather feedback, can also shield them from criticism - and warn signs - that might scare off users.
Gigabud Trojan Exploits Android Work Profiles to Evade Banking App Malware Checks
The sneaky Gigabud Trojan is exploiting Android work profiles to slip past banking app security checks, allowing it to secretly tamper with transactions and drain accounts. By creating a separate work profile, Gigabud can hide in plain sight and facilitate fraudulent payments that appear legitimate.
MantaxOtax Malware Targets Android Devices with Ransomware and Spyware
Meet MantaxOtax, a sneaky malware that's putting Android users on high alert with its potent mix of ransomware and spyware, allowing hackers to hold your device hostage and snoop on your personal life. This hybrid threat can encrypt your files, track your location, and even siphon off sensitive info like contacts, call logs, and gallery content.
Researchers Build WeChat Worm Hijacking Phones via Zero-Click Calls
Meet WeWorm, a powerful tool that can hijack WeChat accounts and take control of phones with just a single, zero-click call - and experts warn that AI has made building such threats faster and more accessible than ever. This alarming innovation can give attackers full control to read and send messages, make calls, and act on a victim's behalf.
Gigabud Malware Exploits Android App Cloning to Evade Detection
Malware attackers have found a sneaky way to evade detection by cloning legitimate Android apps, with a recent campaign racking up an estimated $960,939 in losses across 1,469 compromised devices in Indonesia. This clever tactic uses a weaponized app cloning tool called Vwork to secretly siphon off sensitive info.
WeChat Zero-Click Flaw Exploited to Hijack Accounts via Incoming Calls
A security firm, Calif, has successfully demonstrated a zero-click worm that can hijack WeChat accounts on both iPhone and Android devices with just an incoming call, and fortunately, the exploit has been blocked for all users. This alarming vulnerability was responsibly disclosed to Tencent in July, putting an end to the threat.
THost9 Android RAT Exploits Exposed ADB Services to Spread
Meet the sneaky THost9 Android RAT that's exploiting exposed ADB services to spread its reach - and it can scan a massive 65,025-host range with ease.
Pegasus Spyware Targets Serbian Student Activist via iMessage Exploit
A shocking spyware attack has been uncovered, where a Serbian student activist was secretly infected with Pegasus spyware through a clever iMessage exploit that required zero clicks from the target. This sinister attack allowed the spyware to be delivered undetected, putting the activist's personal data and safety at risk.
Pegasus Spyware Targets Serbian Student Activist's iPhone
A Serbian student activist's iPhone was hacked with NSO Group's notorious Pegasus spyware through a clever zero-click exploit targeting Apple iMessage, according to a joint investigation by Citizen Lab and SHARE Foundation. This sneaky attack allowed the spyware to infect the device without the user even clicking on a link.
Android 17 Bolsters Browsing Privacy with ECH Support
Android 17 just got a major boost to browsing privacy with the addition of Encrypted Client Hello (ECH) support, which teams up with private DNS to keep your online activities under wraps by hiding the domain names you visit. This means you can say goodbye to being profiled by advertisers and hello to a more private browsing experience.
AnonyMousKIT Phishing Service Exploits Voice AI to Harvest iPhone Passcodes
Meet AnonyMousKIT, a sneaky phishing service that's exploiting voice AI to trick iPhone users into spilling their passcodes, fueling a massive operation with over 500 domains and 168 reseller brands. This clever scam uses stolen device info to craft convincing emails and texts that help crooks unlock stolen Apple devices.
WhatsApp Bolsters Sign-In Security with Multi-Device Passkey Support
Big news for WhatsApp users: you can now use multiple passkeys across iOS and Android devices to securely log into your account, making it even easier to protect yourself from phishing and account takeovers. This update allows you to manage multiple credentials directly in the app, streamlining your sign-in experience.
ToxicPanda Malware Exploits VPN Permissions to Evade Google Play Security Checks
Meet ToxicPanda, a sneaky malware that's evolved to outsmart Google Play's security checks by exploiting VPN permissions and controlling device traffic. This cunning threat can now target nearly 350 apps and execute over 160 remote commands, putting your mobile security at risk.
Malware Targets Automotive Head Units
Kaspersky uncovered a surprising new threat in June 2026: a piece of Android malware that targets the Android-based head units found in many cars, using a legitimate system app called TWCore as its unwitting accomplice. This sneaky malware piggybacks on TWCore's update process to spread its reach.
Malware Targets Android Car Systems Through Built-In Updaters
Malware is sneaking into Android car systems through built-in updaters, allowing hackers to wreak havoc on unsuspecting drivers. This sneaky attack was recently discovered by Kaspersky researchers, who linked it to a notorious ad-fraud operation called BADBOX.
ToxicPanda Malware Expands Android Banking Attacks Globally
Meet ToxicPanda 2.0, a highly sophisticated Android banking trojan that's taking global attacks to the next level with an arsenal of 167 remote commands and advanced PIN-harvesting capabilities. This upgraded malware can infiltrate over 140 banking and crypto apps, putting your sensitive info at risk.
ToxicPanda Malware Expands Target List to 140+ Banking and Crypto Apps
Meet ToxicPanda 2.0, a sneaky new Android banking Trojan that's expanded its target list to over 140 banking and crypto apps, allowing attackers to swipe PINs, lock devices, and gain shell-level access. This upgraded malware is particularly alarming, as it operates seamlessly within Android, making it a stealthy threat.
TikTok Reversal Sparks Mobile Security Concerns
TikTok's recent U.S. entity shift has done little to alleviate mobile security concerns, as its privacy policy still raises red flags about invasive data collection and usage. Expert Matt Stern warns that the app's practices remain a threat to user data.
Apple patches image-processing flaw exploited in spyware campaigns
Apple just patched a major security flaw in its ImageIO system that could let attackers run code on your device - and it's already been used in sneaky spyware campaigns targeting high-profile targets.
UNISOC Modem Flaw Enables Remote Code Execution
A newly discovered flaw in UNISOC modem firmware can be exploited to execute arbitrary code with kernel privileges, allowing hackers to gain deep access to Android devices. Simply making a video call to a vulnerable phone can trigger the attack.
Unisoc Exploit Chain Grants Attackers Full Android Kernel Access
Security researchers have uncovered a two-stage exploit chain that can give attackers full access to the Android kernel on devices using Unisoc modem firmware, and alarmingly, the vendor has remained unresponsive to disclosure efforts. This chain can be triggered by a simple malformed video call, putting countless devices at risk.
Apple Alerts 110 Countries to Mercenary Spyware Threats
Apple just sounded the alarm for users in 110 countries, warning them they've been targeted by highly sophisticated mercenary spyware attacks that are among the most advanced digital threats out there. This latest alert is part of a multi-year effort to protect users, with notifications now sent to customers in over 150 countries.