Android Security & Malware
Link
click to show
click to show
WeWorm: The first zero-click worm to spread through WeChat calls across iOS and Android
https://calif.io/research/weworm
42 · 6.9K · Link
click to show
click to show
RCE in mexc Android app via Bypass URL validation to access the WebView, JS-Bridge with Path Traversal leads to Native-Library Cache Overwrite.
https://itis911.github.io/writeups/RCE-Mexc-Andriod-App.html
54 · 7K · Android Security & Malware
Link
click to show
click to show
Vwork: Weaponized Open-source Software as an Addon for Gigabud
https://www.group-ib.com/blog/vwork-app-cloning-gigabud-goldfactory/
18 · 6K · Link
click to show
click to show
Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration
https://zimperium.com/blog/mantax-otax-indonesian-mobile-ransomware-with-spyware-integration
25 · 7.2K · Android Security & Malware
Link
click to show
click to show
RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts
https://zimperium.com/blog/rathat-ai-powered-mobile-threat-is-here-for-your-credentials-bank-accounts
28 · 6.4K · Android Security & Malware
Link
click to show
click to show
Turn a Rooted Android Phone into an NFC Authenticator and Automation Tool for Your PC
https://www.mobile-hacker.com/2026/09/21/turn-a-rooted-android-phone-into-an-nfc-authenticator-and-automation-tool-for-your-pc/
55 · 5.4K · Android Security & Malware
Link
click to show
click to show
Getting root on OnePlus 15 from an untrusted app, via an audio debug service and a vendor HAL
https://blog.nns.ee/2026/09/24/oneplus-root/
37 · 3.9K · Android Security & Malware
Link
click to show
click to show
RemControl: AI Built the Overlays. Victims Lose their PINs
https://www.group-ib.com/blog/remcontrol-android-banking-trojan/
19 · 3.3K · Link
click to show
click to show
A native APK and DEX decompiler written in Rust
https://github.com/Ch0pin/rdx
71 · 3.6K · Link
click to show
click to show
apk-reverse: An Agent Skill for Android APK reverse engineering, debloating, ad removal, surgical dex patching, repacking, and runtime/server analysis
https://github.com/newliver666/apk-reverse
84 · 3.2K · Android Security & Malware
Link
click to show
click to show
From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat
https://www.cleafy.com/cleafy-labs/from-blackcat-to-panda-workshop-inside-the-evolving-c2-panel-behind-rathat
15 · 3K · Link
click to show
click to show
How we found 24 Android vulnerabilities using our open source AI security agent
https://github.blog/security/how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent/
53 · 3.1K · Link
click to show
click to show
CVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF — iOS/macOS kernel vulnerability leading to deferred panic (A19 Pro, iOS 26.3 RC) https://github.com/0xjohnnydev/CVE-2026-20687-AppleJPEGDriver-UAF
36 · 3.1K · Android Security & Malware
Link
click to show
click to show
CVE-2026-86950: The Great Glyph Grift
An in-the-wild iOS bug with a possible WhatsApp zero-click path
Blog: https://calif.io/research/the-great-glyph-grift
PoC: https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-86950
23 · 2.1K · Android Security & Malware
Link
click to show
click to show
CVE-2026-23866: Finding a Whatsapp NDay
https://numb3rs.re/posts/cve-2026-23866-finding-a-whatsapp-nday/
32 · 1.8K · Android Security & Malware
Link
click to show
click to show
The phone was compromised before the user turned it on: the rise of Midnight Mimosa
https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware
37 · 4.4K · Android Security & Malware
Link
click to show
click to show
How I Took Down a ₹1.2Cr Android Banking Fraud
https://medium.com/@im404/how-i-took-down-a-1-2-b4430d997c07
23 · 2.9K · Link
click to show
click to show
Hirudo: From Fake Updates to Patched Banking Apps
https://www.threatfabric.com/blogs/hirudo-from-fake-updates-to-patched-banking-apps
17 · 2.7K · Android Security & Malware
Link
click to show
click to show
LEAD: LLM-Based Static Analysis of Session Hijacking Vulnerabilities in Android Deep Links
https://blog.cykor.kr/2026/10/LEAD-LLM-Based-Static-Analysis-of-Android-Deep-Links
32 · 2.3K · Android Security & Malware
Link
click to show
click to show
Full Android kernel exploit chain built on CVE-2023-20938, a use-after-free in Binder, on a Pixel 6 running Android 12
https://www.eshard.com/blog/kernel-uaf-1-trigger
25 · 1.5K · Android Security & Malware
Link
click to show
click to show
Baohuo, the gray eminence. Android backdoor hijacks Telegram accounts, gaining complete control over them
https://news.drweb.com/show/?i=15076
25 · 4.4K · Android Security & Malware
Link
click to show
click to show
How one exported activity in Microsoft Authenticator let an unprivileged app get tokens for any Microsoft service (CVE-2026-80097)
https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens
28 · 4.4K · Android Security & Malware
Link
click to show
click to show
The Seven Android Trojan Families Targeting Indian Banking Apps
https://www.group-ib.com/blog/cyberdakait-seven-android-trojans-indian-banking/
👍1
20 · 1.9K · Android Security & Malware
Link
click to show
click to show
GhostMap: The Android flaw that crashes your phone before you open the app (not fixed)
https://www.bitdefender.com/en-us/blog/labs/ghostmap-android
👍2
11 · 1.7K · Link
click to show
click to show
Run unsigned code in Download Mode on Samsung (run custom images on locked bootloader for Exynos) - SVE-2026-3546 (CVE-2026-21155)
https://github.com/Gabriel2392/SVE-2026-3546
❤7👍2🔥1
24 · 1.6K ·