Android Security & Malware

Octagon: A New Android Bot Targeting Crypto Wallets and Banking Apps https://iverify.io/blog/octagon-android-bot-crypto-wallets-banking-apps

WindRelay paired with SpyNote RAT enables live-call fraud, combining social engineering with dual digital and physical cash-out. https://www.group-ib.com/blog/windrelay-nfc-spynote-rat-combo-fraud/

LSPosed module for disabling SSL certificate pinning on Android https://github.com/0xdad0/ssl-kill-switch-lsposed

LLM Obfuscation Detection Framework for Android Apps https://github.com/Mobile-IoT-Security-Lab/LLMObfuscDetection

Bypassing Android Hardware Attestation from the Analyst's Chair https://blog.quarkslab.com/bypassing-android-hardware-attestation.html

Kimwolf v7: An Evolution of the Kimwolf Android Botnet https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/

Striking gold: Inside the GoldDigger Android malware https://www.ibm.com/think/security/golddigger-android-malware-analysis

Developers: Beware of Ad Libraries that Betray Your Users’ Location Privacy https://www.eff.org/deeplinks/2026/07/developers-beware-ad-libraries-betray-your-users-location-privacy

Dropping Elephant (Patchwork): Espionage APT Tactics and Tools https://www.picussecurity.com/resource/blog/dropping-elephant-patchwork-espionage-apt-tactics-and-tools

Introducing MobHunt: agentic mobile bug bounty hunting Blog: https://ivrodriguez.com/introducing-mobhunt/ Tool: https://github.com/ivRodriguezCA/MobHunt

Zero-Click File Drop on Xiaomi ShareMe (MiDrop) https://blog.byterialab.com/zero-click-file-drop-on-xiaomi-shareme-midrop/

H96 Android TV Boxes Used for Ad Fraud and Residential Proxies https://www.bitsight.com/blog/fuyao-enterprise-building-ad-fraud-empire-ai-and-kids-coding-blocks

Octagon: Technical Analysis of a Fake Bahrain Civil Defense Application https://labs.k7computing.com/index.php/octagon-technical-analysis-of-a-fake-bahrain-civil-defense-application/

Root My Pixel: is an Android application designed to automate root access on Google Pixel 10 devices leveraging the NebuSec IonStack exploit (CVE-2026-43499) and integrating ReSukiSU / KernelSU https://github.com/alex193a/Root-My-Pixel

Inside an N26 Impersonation Campaign: From Vishing and Fake Control 1.0 to the Copybara Android RAT https://www.d3lab.net/inside-an-n26-impersonation-campaign-from-vishing-and-fake-control-1-0-to-the-copybara-android-rat/

Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon

Fake Bahrain Civil-Defense App Turns a Phone Into a Listening Post https://dreamgroup.com/blog/how-a-fake-bahrain-civil-defense-app-turns-a-phone-into-a-listening-post

List of 140 vulnerabilities in Samsung preinstalled Android apps reported in 2022 https://github.com/oversecured/Samsung_Vulnerabilities

Reading Contact Photos Without READ_CONTACTS: A Google Messages Confused Deputy Bug https://blog.devploit.dev/posts/google-messages-avatarcontentprovider-contacts-bypass/

RedHook Android malware abuses ADB Wireless Debugging and Shizuku to get shell-level privileges https://www.group-ib.com/blog/redhook-android-rat-upgraded/