#mobilesecurity — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #mobilesecurity, aggregated by home.social.
-
CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.
#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel
-
CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.
#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel
-
CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.
#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel
-
CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.
#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel
-
CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.
#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel
-
Android Malware Mantax Otax Encrypts Devices, Steals Data, and Harasses Victims
Beware of Mantax Otax, a sneaky Android malware that's encrypting devices, swiping sensitive data, and even harassing victims - all thanks to clever tricks by Indonesian operators who are using sideloaded APKs to spread the threat.
#AndroidMalware #MantaxOtax #EmergingThreats #MobileSecurity #MalwareOperations
-
Bedtime Bug Hunting at BSides Belfast 🐛
A magic-link login, one badly timed Back button and a very unexpected result.
No fancy tools—just curiosity, testing assumptions and thinking like a real user.
Thanks to everyone who came along and to the BSides Belfast team. Recording coming soon.
https://bsidesbelfast.org/schedule/
#BSidesBelfast #CyberSecurity #AppSec #MobileSecurity #ResponsibleDisclosure
-
Google Play Exposed to Deceptive App Abuse
A sneaky app, "Vice Streets: Open World", racked up over 1 million downloads on Google Play without a single public review or rating, taking advantage of the platform's Early Access feature. This feature, meant to help developers gather feedback, can also shield them from criticism - and warn signs - that might scare off users.
#DeceptiveApp #GooglePlay #MobileSecurity #EmergingThreats #AppAbuse
-
Gigabud Trojan Exploits Android Work Profiles to Evade Banking App Malware Checks
The sneaky Gigabud Trojan is exploiting Android work profiles to slip past banking app security checks, allowing it to secretly tamper with transactions and drain accounts. By creating a separate work profile, Gigabud can hide in plain sight and facilitate fraudulent payments that appear legitimate.
#AndroidBankingMalware #GigabudTrojan #RemoteAccessTrojan #Indonesia #MobileSecurity
-
MantaxOtax Malware Targets Android Devices with Ransomware and Spyware
Meet MantaxOtax, a sneaky malware that's putting Android users on high alert with its potent mix of ransomware and spyware, allowing hackers to hold your device hostage and snoop on your personal life. This hybrid threat can encrypt your files, track your location, and even siphon off sensitive info like contacts, call logs, and…
#AndroidMalware #Ransomware #Spyware #EmergingThreats #MobileSecurity
-
The WeChat zero-click worm WeWorm hijacks accounts through unanswered calls on both Android and iOS. Tencent has fully patched the flaw.
#WeWorm #WeChat #ZeroClick #Tencent #Calif #MobileSecurity #RCE
-
Calif demonstrated a zero-click worm that takes over WeChat accounts on iOS and Android via an incoming call, with no user interaction. It requires the caller to be a contact, enabling self-propagation through compromised address books. Tencent says the vector is now mitigated. #WeChat #ZeroClick #MobileSecurity
https://cyberworldops.eu/en/wechat-zero-click-worm-hijacked-accounts-through-incoming-calls
-
WeWorm is the first zero-click worm to spread via WeChat calls on iOS and Android. Calif researchers found the WeChat RCE flaw - now patched by Tencent.
#WeWorm #WeChat #ZeroClick #Worm #MobileSecurity #RCE #Tencent #Cybersecurity #Calif #InfoSec
-
The new ToxicPanda 2.0 banking Trojan attacks target hundreds of financial apps globally. Learn how this ToxicPanda 2.0 banking Trojan steals credentials.
#ToxicPanda #BankingTrojan #AndroidMalware #CyberSecurity #MobileSecurity
-
После очередного видео о том, как проходить границу РФ (хотя сам я этого делать не собираюсь), решил разобраться, как именно работают комплексы вроде «Мобильного криминалиста» / Cellebrite UFED.
Оказалось, всё довольно плохо: уязвимы практически любые телефоны — и Android, и iPhone, — пока они просто заблокированы, а не выключены.
https://a7.eww.monster/cellebrite-defense/
#Cellebrite #MobileSecurity #infosec #privacy #Android #iPhone #GrapheneOS #DigitalForensics #Андроид #слежка
-
هجوم AnonyMousKIT على مستخدمي iPhone
هجوم AnonyMousKIT على مستخدمي iPhone – 2026 تفاصيل الهجوم : كشفت تقارير أمنية في عام 2026 عن منصة احتيالية تُعرف باسم AnonyMousKIT، طورتها جهات إجرامية لاستهداف أصحاب أجهزة iPhone المفقودة أو المسروقة. تعتمد المنصة على التصيد الاحتيالي (Phishing) والهندسة الاجتماعية (Social Engineering) لخداع مالك الجهاز […] -
A new Manic Android malware campaign combines banking fraud and spyware, using a unique offline mesh relay to steal data even without internet access.
#Manic #AndroidMalware #CyberSecurity #ThreatFabric #MobileSecurity
-
iOS 26.6.1 & 18.7.10 Update: Fix iPhone Bugs Now
#TycoonWorld #iOS26 #iOS2661 #iOS18710 #Apple #AppleSecurity #iPhone #iPhoneUsers #iPhoneSecurity #iOSUpdate #AppleUpdate #SecurityUpdate #CyberSecurity #CybersecurityNews #WebKit #KernelSecurity #ImageIO #ZeroClickAttack #Spyware #MobileSecurity #AppleNews #TechNews #TechnologyNews #iPhoneUpdate #SoftwareUpdate #SecurityFlaws #Privacy #DigitalSecurity #CyberThreats #TechUpdates #LatestTechNews
https://tycoonworld.in/ios-security-update-warning-iphone-users/
-
📱 Porto, ready for some mobile hacking? 🇵🇹
🔥 4h hands-on Android & iOS workshop with Abraham Aranguren at #OWASP AppSec Days Portugal.
⚔️ Real attacks. Real pentest cases. Practical exercises.
-
That answered VoLTE video call might be more dangerous than it looks.
Researchers demonstrated an attack chain that can reach Android’s deepest system level on certain devices using Unisoc chips, including the Motorola E13, Realme C33 and Xiaomi Redmi A5.
The attacker needs a private 4G network—but there’s still no official patch available.
Find out how the chain works.
-
Un nombre « sans précédent » d'utilisateurs Apple ont reçu une alerte spyware. Le terme est fort — mais ce qui compte ici, c'est la surface d'attaque : des appareils grand public ciblés par des outils jusqu'ici réservés à des cibles très précises. La démocratisation du spyware commercial, c'est peut-être ça le vrai signal. #infosec #spyware #mobilesecurity
https://techcrunch.com/2026/08/17/unprecedented-number-of-apple-users-received-recent-spyware-alert-say-investigators/ -
Losing your phone is no longer just an annoyance.
Read the blog: https://marshsecurity.org/protecting-against-lost-stolen-mobile-microsoft-security/Losing your phone when it contains access to your email, Microsoft 365, MFA, corporate data, personal accounts, banking, photos and potentially your entire digital identity is a little more serious than "annoyance".
I’ve published a new post looking at what you can do to reduce the impact of a lost or stolen mobile device, both from a personal perspective and also within a business. This blog covers some of the practical protections available through Microsoft and modern device management, as well as the steps worth taking before a device disappears.
Because realistically, the best time to think about how you’d respond to a lost phone probably isn’t five minutes after realising it’s no longer in your pocket.
Read the blog: https://marshsecurity.org/protecting-against-lost-stolen-mobile-microsoft-security/
Tags:
#Microsoft #Security #Cyber #Tech #Technology #CyberSecurity #MicrosoftSecurity #MicrosoftIntune #Intune #Microsoft365 #EntraID #IdentitySecurity #MobileSecurity #InformationSecurity #DataProtection -
🏆 Congratulations to COSIC researcher Tim Vlummens and co-authors!
Their paper, "Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost", received the Internet Defense Prize 2026 at #USENIX Security Symposium and was also selected as a Distinguished Paper.
Their research revealed how Meta and Yandex used localhost communication on Android to link web browsing data to app identities, bypassing privacy protections designed to separate web and app contexts.
#Privacy #MobileSecurity -
AI-driven Mobile Anti-Scam tools are becoming essential for protecting users and businesses alike. This short read explains the latest advancements for Android and iOS and why integrating intelligent detection is critical for reducing fraud risk. https://wix.to/FuGmL6X
-
Can privacy tools become evidence?
Episode 445 of Shared Security looks at the GrapheneOS phone-wipe case and the bigger privacy concern: when strong security tools get reframed as suspicious behavior. Tom and Scott discuss airport searches, duress codes, and practical threat-modeling for anyone traveling with sensitive data.
Full episode: https://youtu.be/Cch3pG2EO-g
#SharedSecurity #Cybersecurity #Privacy #GrapheneOS #MobileSecurity #InfoSec
-
Einordnung: Zero-Click-Lücken sind für Nutzer besonders unangenehm, weil man eben nichts »falsch anklicken« muss. Der Fall zeigt, wie viel Angriffsfläche schon entsteht, wenn ein Gerät eingehende Inhalte automatisch verarbeitet. Regelmäßige Sicherheitsupdates bleiben hier praktisch die einzige realistische Verteidigung.
2/2
-
RedWing Android malware is a rental spyware sold as malware-as-a-service on Telegram. It steals banking logins, intercepts 2FA, and hijacks phones.
#RedWing #AndroidMalware #MalwareAsAService #Spyware #BankingTrojan #MobileSecurity #InfoSec #Telegram
https://securityonline.info/redwing-android-malware/?utm_source=mastodon&utm_medium=jetpack_social
-
Fileless RCE on stock Android (~2.5B devices). Reported to Google VRP, confirmed by their own engineering team, closed as NSBC anyway.
#AndroidSecurity #infosec #Android #MobileSecurity #VulnerabilityResearch #RCE #BugBounty #VRP #ResponsibleDisclosure #AppSec #ThreatIntel #WebView #ZeroDay #CVE
-
Stolen phones - and specifically iPhones - have robust anti-theft protections. They are worthless once they're flagged - locked to their owner. So why are millions still being stolen every year?
In this paper, we uncover a thriving underground marketplace focused on unlocking stolen phones. It is powered by:Lookalike domains impersonating Apple, Xiaomi, Samsung and other brands
Smishing campaigns targeting device owners
Pay‑as‑you‑go “unlocking” tools sold on Telegram
By pivoting on DNS data, we identified 10,000+ malicious domains and a growing ecosystem turning locked devices into profit at scale.👉 Read how this supply chain works—from theft to resale—and why it’s growing fast. https://www.infoblox.com/blog/threat-intelligence/lookalike-domains-expose-the-iphone-theft-economy/
#ThreatIntel #CyberSecurity #Phishing #MobileSecurity #iOS #Smishing #dns #threatintelligence #cybercrime #infosec #infoblox #infobloxthreatintel #threatintelligence #cybercrime #infosec #infoblox #infobloxthreatintel
-
Comparison of Android-based Operating Systems
👑 #GrapheneOS 👑
https://eylenburg.github.io/android_comparison.htm
@GrapheneOS
#grapheneOSFoundation #Graphene #GrapheneOS #Googlepixel #Motorola
#DeGoogle#DeGoogledAndroid #AndroidFork #AndroidOS #DegoogledPhone #hardened #Android #Privacy #Security #CyberSecurity #MobileSecurity #InfoSec #DigitalSecurity #HardenedAndroid #OpenSource #AOSP -
📬 Oblivion Android RAT: Kapert SMS, 2FA und umgeht Schutzmechanismen bis Android 16
#ITSicherheit #Malware #2FA #AccessibilityService #Android16 #AndroidMalware #AndroidRAT #HiddenVNC #MalwareasaService #MobileSecurity #Oblivion #PermissionBypass https://sc.tarnkappe.info/345ceb -
Greek police arrested scammers using a fake cell tower for SMS phishing.
Phones were forced onto insecure 2G networks to harvest data and send bank-themed smishing.
Thoughts?
-
Hackers Exploiting Microsoft Flaw to Attack Governments, Businesses – Source: securityboulevard.com https://ciso2ciso.com/hackers-exploiting-microsoft-flaw-to-attack-governments-businesses-source-securityboulevard-com/ #SecurityBoulevard(Original) #MicrosoftSharePointServer #rssfeedpostgeneratorecho #ThreatIntelligence #0dayvulnerability #CyberSecurityNews #SecurityAwareness #SecurityBoulevard #MicrosoftWindows #Threats&Breaches #Identity&Access #NetworkSecurity #vulnerabilities #MobileSecurity
-
Join Jeroen Beckers at OWASP Global AppSec EU 2025 in Barcelona on May 29!
🔗 Register: https://owasp.glueup.com/event/123983/register/
From secure coding practices to the impact on SAST, DAST, and manual testing, this talk is a must for anyone securing modern mobile apps across platforms.
Learn how to embed security into every phase of mobile app development—see you there!
#OWASP #AppSecEU2025 #MobileSecurity #Flutter #ReactNative #CrossPlatform #SecureDev #Barcelona #OWASPMobile
-
FIDO: Consumers are Adopting Passkeys for Authentication – Source: securityboulevard.com https://ciso2ciso.com/fido-consumers-are-adopting-passkeys-for-authentication-source-securityboulevard-com/ #SecurityBoulevard(Original) #Passwordlessauthentication #biometricsauthentication #rssfeedpostgeneratorecho #CyberSecurityNews #SecurityBoulevard #Identity&Access #NetworkSecurity #MobileSecurity #SocialFacebook #SocialLinkedIn #CloudSecurity #Cybersecurity #datasecurity #FIDOAlliance #DataPrivacy