Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Android. Show all posts
malware
AccessibilityService API advanced protection Android android 17 API Browser Google Intrusion Logging feature malware

Google's Android 17 Locks Accessibility Services to Verified Apps as Malware Threat Branches Out




Google is tightening restrictions on one of mobile malware's most persistent entry points. With Android 17, the company is limiting access to its AccessibilityService API to verified Accessibility Tools only, a change that takes effect the moment a user switches on Advanced Protection.

The move, announced Thursday, targets a problem that has haunted Android security for years. The AccessibilityService API was built to help people with disabilities use their smartphones. Screen readers, voice control apps, and motor-assistance tools all rely on it. But the privileges it carries are significant. Apps that tap into the API can run in the background, observe what appears on screen, intercept UI events, and take actions inside other applications on a user's behalf. That set of capabilities made it a target for malware developers almost immediately after it was introduced.

Google stated in its announcement that the new version automatically restricts AccessibilityService access to verified Accessibility Tool applications, closing off a major attack avenue while keeping genuine assistive technology functional.


A Clichéd Attack Path

Malware families have been weaponizing Android's accessibility services since at least 2017. The list of known offenders runs long: Vultur, SharkBot, Xenomorph, BianLian, Anatsa (also tracked as TeaBot), and more recently BTMOB RAT, a remote access trojan documented attacking banking customers across Brazil, Argentina, Spain, Portugal, and Mexico through 2025 and 2026. According to Kaspersky data, trojans accounted for 40 percent of Android malware infections in Q1 2025, with nearly 12 percent of malicious apps falling into the banking trojan category that specifically abused the Accessibility API, totaling around 154,000 apps.

The attack chain is well understood. A malicious app, typically distributed through sideloaded APKs or disguised as something routine, tricks a user into granting accessibility permissions. The Anatsa trojan, for instance, slipped onto Google Play as a PDF viewer update as recently as July 2025. Once the permission is granted, the malware operates without root access. It can monitor keystrokes, layer fake login pages on top of legitimate banking apps, approve system dialogs silently, and initiate fraudulent fund transfers from financial applications without the user noticing anything unusual on screen. Google noted in its announcement that this access also allows malware to block its own uninstallation, locking users out of any easy remedy.


What Changes in Android 17

The new restriction applies specifically when Advanced Protection is active, a device-level security mode introduced with Android 16 that consolidates multiple hardening features under a single toggle. When a user enables it, the system now automatically enforces that only verified, legitimate accessibility apps can request AccessibilityService access. Everything else is denied.

This is part of a gradual tightening that has been underway for several years. Android 13 made it significantly harder for sideloaded apps to acquire accessibility permissions. In-call protections, rolled out more recently, prevent users from granting those permissions during a phone call, cutting off a common social engineering scenario. Google also introduced the `accessibilityDataSensitive` flag to let developers mark UI elements as off-limits to third-party accessibility readers.


The Rest of Android 17's Security Updates

The accessibility change is one piece of a wider hardening effort in Android 17. Intrusion Logging, developed in collaboration with Amnesty International's Security Lab and other civil society organizations, creates a persistent, privacy-preserving forensic record of sensitive system events. Amnesty's team simultaneously updated AndroidQF and its Mobile Verification Toolkit to process the new log format, making it immediately useful for researchers investigating suspected spyware infections.

USB Protection blocks new data connections over a USB port while the device is locked, preventing physical access attacks where an attacker might attempt to extract data or push commands through a connected cable. Google has also included an option to disable WebGPU, a graphics API that has surfaced in sophisticated browser-based exploit chains. Failed Authentication Lock responds to repeated incorrect login attempts by locking the device entirely, making brute-force attempts against a stolen or seized phone substantially harder.

A fifth addition, View Supporting Apps, gives users a clear window into which installed applications have checked whether Advanced Protection is active on the device.

For developers, Google confirmed that applications can receive a notification when a user enables Advanced Protection, allowing them to switch on their own high-security features automatically for that audience.

Existing Advanced Protection users will receive a notification when the new capabilities land on their device. Intrusion Logging is not switched on by default and must be enabled manually from the Advanced Protection settings page.


Read more »
Windows
Android Antivirus apis Data Theft Firefox Linux macOS privacy Windows

File Notification APIs in Windows, Linux, and Android Are Leaking What You Do on Your Computer

 



A research team from Graz University of Technology in Austria has shown that a routine feature built into virtually every major operating system can be turned into a surveillance channel that tracks keystrokes, visited websites, and private messaging activity without needing administrator access.

The feature is the file-change notification system. Every major platform ships one: Linux has inotify and fanotify, Windows uses ReadDirectoryChangesW, and Android and macOS have their own equivalents. Text editors, antivirus software, cloud sync clients, and file managers depend on these APIs to react when files are created, modified, or deleted. The catch is that subscribing to those notifications requires no special privileges, only read access to the directory being watched.

What these APIs never hand over is actual file content. What they do leak, the researchers found, is file names and the exact timing of events. That combination is enough to reconstruct meaningful details about what other users on the same machine are doing throughout the day.


Linux: Keystrokes Through the Filesystem

On Linux, if a process is blocked from watching a specific file directly, it can still receive that file's events by watching the parent directory, as long as that directory is readable. The researchers applied this to device files under /dev that represent keyboard hardware. The result is that an unprivileged process can detect every keystroke another user makes, though not which key was pressed.

That gap offers less protection than it appears to. Research going back more than two decades has established that the rhythm of inter-keystroke timing can help reconstruct what was typed. In tests with seven participants, the attack scored between 93.1% and 100% on standard accuracy measures. Input that never echoes to the screen, such as a password entered during a sudo prompt, does not generate filesystem events and stays invisible to the attack.

The team also demonstrated website fingerprinting by watching which system fonts Firefox loads for a given page. Against the top 100 sites, that technique reached 87.9% accuracy. A third Linux attack targeted KDE Plasma 6 on Wayland: a malicious process running as the victim can detect when a real authentication dialog is about to appear and draw a counterfeit one over it to capture credentials before the legitimate prompt ever loads.


Android: No Permissions Required

On Android, an application requesting zero permissions can watch the private storage directory of a completely separate app. Testing against WhatsApp on a Google Pixel and a Samsung Galaxy device, the researchers extracted file names and event timing that revealed when photos, videos, and documents were sent or received. The attack also exposed when that media was later deleted, offering a window into communication patterns that the app's own privacy controls do not address.


Windows: One Watch, Every User's Files

The most consequential Windows scenario arises when a process watches the root of the system drive. Windows reports the full path of every file that changes anywhere on the machine, including paths inside other users' home directories that the monitoring account has no direct permission to access.

Because Firefox names profile subdirectories after associated websites, an unprivileged user watching the drive root can track which sites another logged-in account is browsing in near-real time. Across the top 1,000 websites, the researchers hit 97.8% accuracy against Firefox and 48.5% against Edge, which creates far fewer site-named folders.

This behavior comes from the same ReadDirectoryChangesW API that was flagged under CVE-2007-0843 for a similar class of issue almost two decades ago. Microsoft's position has not shifted. The company told the researchers the behavior is working as designed, on the grounds that file contents remain inaccessible. A Microsoft spokesperson told SecurityWeek that "the technique requires an attacker to already have the ability to run code locally on a device under a separate user account and does not provide access to file contents." Microsoft did note that administrators can enable optional protections it documented in April 2025 covering some path-disclosure scenarios tied to directory change notifications.

macOS came out the least exposed of the four platforms. Its equivalent API can only monitor globally readable files, which limits the attack surface, though the researchers still demonstrated tracking of application launches, app interactions, and settings changes.

The Linux kernel received a targeted patch under CVE-2025-68788, which stops the fsnotify subsystem from generating access and modify events for special files, including the device files representing keyboard input. The researchers describe this as addressing the most serious Linux issue, but other attack paths from their research remain open.

Apple and Google have not responded to requests for comment, and no fixes have been announced for Android or macOS. The researchers say they have found no evidence of active exploitation in the wild. Proof-of-concept code for the full set of attacks has been published on GitHub at isec-tugraz/file-notification-attacks.



Read more »
Windows
Account Hijacking Android Apple Zero-Day Vulnerabilities iOS Malicious calls Vulnerabilities and Exploits WeChat Windows

One WeChat Call Was Enough to Hijack Accounts Across iPhone and Android

 



A new wave of WeChat vulnerability can turn an incoming voice call into a zero-click account takeover, enabling a compromised account to target another contact without requiring the recipient to answer the call or interact with the device.

Security researchers at Calif developed the exploit and demonstrated its worm-like propagation across an iPhone and two Android devices. In the test, an Android phone called an iPhone and compromised its WeChat account while the incoming call was still ringing. The compromised iPhone then called a second Android phone, allowing the researchers to repeat the takeover.

The attack depends on the caller already being listed as a WeChat contact of the target. Calif said this is not necessarily a strong protection because compromising one account can give an attacker access to that user's trusted contacts, creating opportunities to propagate the attack through existing relationships.

The recipient does not need to answer the call. Calif said answering it also does not prevent exploitation, with the victim hearing nothing while the attack continues. Rejecting the call stops that individual attempt, but an attacker can simply place another call later. This could allow repeated attempts when a target is unavailable, including while the person is asleep.

According to Calif, the vulnerability affects WeChat's VoIP functionality and involves memory corruption. Successful exploitation provides control over the victim's WeChat account, allowing an attacker to read and send messages, make calls and operate the account as its owner. The researchers stressed that the vulnerability by itself does not provide control of the entire smartphone. Chaining it with separate device vulnerabilities could, however, potentially extend an attack beyond the application.

Calif has not released the exploit's technical details and plans to present its full research at a security conference. The company said its researchers used an AI-assisted system designed to explore attack surfaces in messaging applications to identify the vulnerability. Calif said its engineering team identified the bug on July 23, completed an Android exploit on July 30 and demonstrated the worm on August 11. It separately described the initial exploit development as taking about two days, followed by roughly another week to build the worm.

The researchers disclosed the issue to Tencent in July. Tencent subsequently released WeChat 8.0.77 for Android and 8.0.76 for iOS on August 21. Calif said those updates mitigated its exploit and that it confirmed on August 28 that Tencent had also blocked the attack on its servers. On September 4, Calif said Tencent confirmed that the vulnerability could be exploited for remote command execution.

The server-side mitigation means users do not necessarily need to install an update for the specific exploit to be blocked. Keeping the application updated remains advisable, particularly because Tencent has not published a complete list of affected versions. Calif said it tested against Android 8.0.76 and iOS 8.0.75, including iOS 26.6 and older Android releases.

Tencent has not publicly issued a security advisory describing the vulnerability, while its release notes characterize the relevant updates as bug fixes. The company also distributes WeChat clients for HarmonyOS, Windows, macOS and Linux, but Calif has not disclosed whether those versions were tested.

The risk extends beyond private conversations because WeChat incorporates services including payments, official accounts and mini programs. Tencent reported 1.439 billion combined monthly active users for WeChat and Weixin as of June 30, 2026, giving an account-level compromise potential consequences beyond ordinary messaging.

There is currently no indication that the flaw was used in attacks against WeChat users. Calif has not reported an active campaign, and the researchers have not published indicators that defenders could use to identify exploitation. As of September 8, checks also found no CVE identifier for the vulnerability and no corresponding advisory on Tencent's security response site.

The discovery adds to a continuing security concern around zero-click vulnerabilities in communications software. Such attacks can exploit data automatically processed by an application before a user accepts an incoming communication, removing the conventional requirement for a victim to click a malicious link or open an attachment.

Calif's demonstration therefore presents two distinct risks: the immediate compromise of a WeChat account and the possibility of automated propagation through trusted contacts. While Tencent has blocked the demonstrated exploit, the absence of a public technical analysis means users cannot independently determine from the available information whether older or alternative WeChat builds were vulnerable.

Read more »
Hardware Bug
Android Android Smartphone Android Softwares Cyber Security Google security Hardware Bug

Why Andy Rubin’s Essential Phone Failed Despite Fixing Android’s Biggest Problems

 

Andy Rubin spent ten years creating Android before launching Essential Products, which was based on the idea that Android phones had too many compromises, such as bloatware, software skins, slow updates, and accessories that became obsolete when new hardware was released. Essential launched the PH-1 in August 2017, which had near-stock Android, premium materials, fast updates, and a display that extended to the edges. 

Rubin had co-founded Android Inc. with Rich Miner, Nick Sears, and Chris White in 2003, and Google bought the company in 2005 for $50 million. Rubin continued to lead Android’s development for the next eight years. The PH-1 was meant to overcome some of the shortcomings of the open-source platform. It had Android 7.1.1 and was expected to receive two major Android upgrades and three years of monthly security updates. 

Essential delivered on Android 9 and Android 10, the same day as Google’s Pixel phones. The hardware was also supposed to overcome Android’s challenges. The phone had a titanium frame and a ceramic back, and it was among the first smartphones to have a notch. It had magnetic pins on the back, which were supposed to allow accessories to snap onto the phone instead of using a USB-C port. Essential announced a 360 camera and an audio adapter, but the ecosystem was never realized.

The launch of the PH-1 did not go well for Essential. The company announced that the phone would be available for purchase within 30 days, but the first units were not shipped until August 25 th , nearly two months after launch. The camera was also heavily criticized, and the $699 price was permanently reduced to $499 only two months after its launch. The only US carrier that sold the Essential PH-1 was Sprint. Essential’s sales were also underwhelming despite the star power of Andy Rubin.

A $300 million funding round in 2017 valued Essential at around $1.2 billion, but Bloomberg revealed that Essential had only sold 150,000 phones by May 2018. In October 2018, The New York Times revealed that Google had investigated a sexual harassment complaint against Rubin and found the allegations credible. Google approved a $90 million exit package for Rubin, but he denied the allegations. 

The report received a negative reaction from many Google employees, and Rubin’s reputation became a liability for Essential. Essential also announced Project Gem, a tall and thin smartphone that was designed to be used with one hand. The phone never reached the market, and Essential filed for bankruptcy on February 12 th , 2020, after realizing that there was no viable way to bring the phone to the market. The PH-1 was a lesson that high-end materials, limited software, and fast updates were not enough for a struggling smartphone brand to survive. 

The phone’s troubled launch, limited accessories, poor camera, and lack of network support hindered its chances, and Essential was unable to turn it around. The company realized that its ideas were not scalable enough to sustain a smartphone manufacturer, and it filed for bankruptcy later in 2020.
Read more »
Malware Attack
Android Android Ecosystem Android Trojan BTMOB Malware Cyber Security Malware Attack

BTMOB Android RAT Ecosystem Expands With Resellers, Source-Code Sellers and Impersonators

 

The Android remote access trojan known as BTMOB most likely began as a centralized malware-as-a-service operation but transformed into a wider ecosystem, with resellers, source code buyers, rogue operators, and possibly even impersonators, according to the Flare researchers. BTMOB is a remote access trojan for Android devices that takes the form of malware-as-a-service.

It offers an “exploit chain,” that is, a malicious application, droppers, a payload builder, a Windows operator panel, servers, and phishing and credential-stealing tools. All of the components may be purchased in various combinations, depending on the chosen subscription plan. Some of the options include private infrastructure, customized builds, and technical support. The Flare researchers analyzed thousands of relevant forum and chat threads to document BTMOB’s activity and distribution channels. 

They tracked the malware’s progress from its first appearances in mid-2025 to the present day. In their findings, the researchers observed that while an official channel was distributing the service and its components, other purportedly independent channels and forums sold subscriptions, reseller panels, code, and even alternative versions of the malware under the same name. In particular, the official account announced the V2 of the malware for rent or sale for $700 per month, $3,000 for a lifetime subscription or $5,000 with additional monthly payments for the private infrastructure and support. Less than a month later, the same account announced technical issues and claimed that over 4,000 devices were connected to BTMOB’s servers. 

According to the researchers, the account advertised a full source code and setup instructions for BTMOB for $20,000. The package included PHP and Node.js server components, a VB.NET control panel and Java Android code. The advertised source-code price later fell to $10,000 in May 2025. Additionally, they noticed that the Spanish/Portuguese Telegram channel had an issue between two admins, one of whom left the project. The main channel then announced that from now on, all the administrators would function independently. 

It also stated that one of them, based in Brazil, had bought the source code and was running his own fork of BTMOB. After that, the secondary market appeared and started advertising much cheaper alternatives to the official subscription. In particular, one Telegram campaign announced the lifetime access to version 4.1.2 and 4.2 of BTMOB for $500 and purported RAT and server source code for $1,500. Other channels and forums also offered subscriptions, reseller panels, source code, and lifetime accounts for different prices and conditions.  

It is unclear whether the accounts offering the alternative versions of BTMOB are legitimate or not, as many of them could have used pirated materials or have been scams. For example, the official account warned all their partners that there is only one official BTMOB channel and that other accounts do not represent the company and are not affiliated with it. 

Nevertheless, the official account advertised the V4.1 release in February 2026 and V4.5 in April 2026. According to the announcement, the subscription for the private server hosting of several accounts costs about $1,200 lifetime account, a $3,000, and the source code for the server itself costs $7,000.
Read more »
User Privacy
Android Chrome Cloud Data Google Internet User Privacy

Google Chrome's New Defense Model to Protect Users Against Malicious Notifications


According to Google, Chrome’s anti-abuse system has decreased unwanted notifications in the first quarter of 2026 by over 7 billion daily on Android.

In a new blog post, Google said that notification exploits have been used to spread malware, scams, fake payment requests, and phishing attempts.

To decrease the exploit, Google made a “Swiss cheese” defense system, where numerous overlapping systems simultaneously try to stop exploit at different levels.

According to Google, "Our goal is to ensure that if abuse slips through one layer, another is there to catch it. This approach allows us to halt abuse at the source, preventing deceptive content from reaching users while maintaining a healthy balance between utility and security."

Automatic notification permission removal by Chrome

Currently, Chrome can already revoke notification permissions from inactive sites, and also from websites that continuously give suspicious-notification warnings.

This can automatically unsubscribe a user from a website’s notification if Chrome removes the permission.

According to Google, users can still see the automatically revoked permissions in Safety Hub and permit access again if they wish to.

Users can also unsubscribe from notifications directly from the notifications panel of Android.

Besides allowing users more control, Google is studying user behaviour throughout networks of associated websites. This includes coordinated service-worker activity, to look out for groups spreading harmful or malicious notifications. 

According to Google, "This enables us to proactively revoke permissions from these persistent bad actors, protecting users from deceptive notifications even when the site content might not seem inherently malicious."

Google analyzes factors including time you spend on a website, engagement, permission-prompt frequency, and notification volume. 

For instance, websites categorized as malicious can be restricted to 1,000 messages per minute, with additional requests showing an HTTP 429 error. These restrictions are reset after a period of non-disruptive behaviour and can be more strict for repeat violators, Google said.

Users can also control notification settings

Chrome has also modified how notification permissions prompts function on Android. Chrome has built a relatively less disruptive interface for users to decide if they want certain notification without poking their browsing. 

"This strategy has substantially decreased unnecessary background activity, reduced user device battery consumption, and transformed the notification lifecycle so users receive only the content they find truly valuable," Google said.

How to turn on settings

For users who want to manually control these settings, for Chrome users, “On Desktop, navigate to Settings > Privacy and security > Site Settings > Notifications, or open chrome://settings/content/notifications in the omnibox,” Google said.

For android, “tap More (⋮) > Settings > Notifications.”

Read more »
Meta Platforms
Android Android Update Backup Backup Protection Chat Apps Cyber Security Data Backup Data Management Google Updates Meta Platforms

WhatsApp Tests New Android Chat Backup Management Feature to Improve Google Drive Storage Control

 

Managing WhatsApp backups on Android might become significantly easier in the future as the messaging platform prepares new solutions to give users more control over their data. The upcoming update will allow people to organize and delete old backups, thus saving space on their devices and ensuring a better management of information stored on Google Drive. 

WhatsApp has been working on the tool for quite some time, while it has not been publicly available yet. Reporters found out about the future feature as they explored the latest beta version of the app. The new tool will appear in the Backup section and will enable users to delete old backups directly from WhatsApp, thus providing more space for data stored on Google Drive. 

This update will make managing storage much easier for millions of Android users who experience difficulties deleting excess data from Google Drive. The update comes as WhatsApp continues working on new ways to improve its cloud backup system. Last year, reporters learned about the company’s plan to create its cloud storage system. That way, WhatsApp users will be able to store their backups on Google Drive or the company’s cloud. 

According to the publication, WhatsApp’s storage will offer 2 gigabytes of space for free, and an additional 10 gigabytes can be acquired for a small fee. Moreover, regardless of the storage method, WhatsApp backups will be end-to-end encrypted. The encryption can be supplemented by a passkey, a regular password, or a 64-digit code. At the same time, WhatsApp has not abandoned its reliance on Google Drive. The application updates in 2021 demonstrated Android users’ demand for more control over their WhatsApp backups. 

Developers worked on ways to meet the users’ requirements and made the new in-app management system more accessible by adding shortcuts to Google Drive’s management system and Android’s built-in settings. In the same vein, Google has also been working on ways to provide more convenience and flexibility for Android users. Recently, Android users have received an additional tool to manage WhatsApp backups. 

With version 26.23 of Google Play Services, users gained the ability to view and control their WhatsApp backups directly from their device’s Settings menu. Thus, the Settings page now offers access to WhatsApp backups without having to open the messaging app. Right now, WhatsApp users can back up their chats, media files, voice notes, and other content to Google Drive. The application can automatically perform backups every day, weekly, or monthly. 

To restore a backup, one has to reinstall WhatsApp on their device and log in with their Google and WhatsApp account. The upcoming update will allow Android users to manage backups directly in WhatsApp, complementing Google’s newly introduced settings. The new system for managing WhatsApp backups will enable Android users to delete unwanted backups directly inside the application. 

That way, the update will enable more control over the backups, which will help the users that have multiple devices or simply change their smartphones too often. Having more than one phone results in multiple backups, whereas excessive WhatsApp backups consume more space on Google Drive. Though WhatsApp has not announced when the update will be released, it should come in the near future. 

After Google released its new system that allows Android users better control over WhatsApp backups, the update can be available to users soon. If the update arrives in 2022, Android users will appreciate the additional flexibility and convenience of managing their WhatsApp backups while keeping their data safe and secure.
Read more »
USB C
Android Connectors Ethernet Hardware HDMI SD USB C

Why a USB-C Hub Is Becoming an Essential Accessory for Modern Phones and Laptops

 





The push toward thinner smartphones and lightweight laptops has transformed device design over the last decade. While manufacturers have succeeded in reducing size and weight, the transformation has often come at the cost of connectivity. Many modern devices now rely on a single USB-C port for charging, data transfer, and external accessories, leaving users without many of the ports that were once standard.

As a result, consumers frequently turn to individual adapters whenever they need to connect older hardware. A separate adapter may be required for an external monitor, another for a USB flash drive, and yet another for reading camera memory cards. What begins as a simple attempt to restore missing functionality can quickly turn into a collection of small accessories that must be carried, organized, and replaced when lost.

Technology users who work across multiple locations often encounter this challenge. A forgotten HDMI adapter can prevent a presentation from being displayed on a monitor. Leaving behind a memory card reader can delay the transfer of photos and videos. Even a missing USB adapter may stop a user from connecting a keyboard, mouse, or storage device when it is needed most.

Multi-port USB-C hubs have emerged as one solution to this growing connectivity problem. Instead of requiring separate accessories for different tasks, these devices combine multiple ports into a single unit that connects through a USB-C interface. Depending on the model, a hub may include HDMI output, USB-A ports, SD and microSD card readers, Ethernet connectivity, and pass-through charging support.

The primary advantage is convenience. Rather than managing several individual adapters, users only need to carry one accessory capable of supporting a wide range of devices. For people who frequently travel or work remotely, reducing the number of cables and connectors can simplify setup and minimize the chances of leaving behind a critical component.

Many hubs also allow smartphones to support more advanced desktop-style workflows. Certain Android devices can connect to external displays through HDMI, enabling users to work on a larger screen while simultaneously using a keyboard and mouse. This approach can create a workstation-like environment without requiring a traditional computer for basic productivity tasks.

However, not all USB-C hubs deliver the same level of performance. Buyers should examine specifications carefully before making a purchase. Factors such as transfer speeds, display resolution support, charging capacity, and the total number of available ports can vary considerably between products.

Power management is another important consideration. When multiple accessories are connected simultaneously, a hub may draw power from the host device. For this reason, many manufacturers offer pass-through charging capabilities that allow a charger to supply power to both the hub and the connected phone or laptop. Some models advertise support for charging rates up to 100 watts, although part of that power is consumed internally to operate the hub and connected peripherals.

Despite the industry's migration toward USB-C, many commonly used accessories continue to rely on older USB-A connections. Flash drives, printers, wireless mouse receivers, gaming controllers, and other peripherals still use the legacy standard. A hub can serve as a bridge between newer devices and existing hardware without requiring users to replace all of their accessories.

Memory card support remains particularly useful for photographers, videographers, and drone operators. Integrated SD and microSD slots allow media files to be transferred directly from cameras and storage cards without requiring dedicated readers. Some higher-end hubs can access both card formats simultaneously, reducing the need to repeatedly swap storage media during large file transfers.

Display connectivity is another frequently used feature. Many USB-C hubs provide HDMI output capable of supporting high-resolution external monitors. When paired with compatible devices, this allows users to extend their workspace, view content on larger screens, and improve multitasking capabilities.

Cost considerations may also influence purchasing decisions. While individual adapters often appear inexpensive when purchased separately, the combined cost of HDMI adapters, memory card readers, USB converters, and Ethernet accessories can exceed the price of a single multi-port hub. Consolidating these functions into one device may also reduce the need for repeated replacement purchases caused by misplaced or damaged adapters.

As manufacturers continue to streamline hardware designs and reduce the number of built-in ports, USB-C hubs are increasingly being used to restore connectivity options that many users still depend on. For individuals who regularly connect external displays, storage devices, memory cards, or older peripherals, a multi-port hub can provide a practical way to expand the capabilities of both smartphones and laptops through a single connection.

Read more »
website
Android Cyber Security OSINT sensitive information spyware website

Android Spyware ‘Asin’ Uses Fake News and Utility Apps to Target Arabic-Speaking Users




Researchers at ESET have identified a previously undocumented Android spyware strain called Asin that is being distributed through fraudulent websites aimed at Arabic-speaking users.

According to the security company, the activity was first observed in early 2025 and involved several separate campaigns. The operators used different websites during each phase of the operation, presenting them as legitimate services to encourage users to download malicious Android applications.

Among the websites identified by researchers was govlens[.]net, which was registered in May 2025 and presented itself as a government-related news platform. Another site, pdf-reader[.]help, registered two days later, claimed to provide secure PDF viewing and editing capabilities. A third domain, live-war-map[.]com, registered in January 2025, advertised itself as a source of information about military incidents and conflict activity.

ESET found that some of these websites were promoted through social media accounts on Facebook and Telegram. The campaign's Telegram presence appeared to draw inspiration from Live Universal Awareness Map (Liveuamap), a legitimate service widely used to monitor armed conflicts, humanitarian crises, natural disasters, human rights developments, and geopolitical events around the world.

While the websites offered services that appeared useful or relevant to their intended audience, the downloaded applications contained hidden spyware components. Researchers said the malicious apps combined advertised functionality with surveillance capabilities operating in the background.

Additional evidence suggests the campaign remained active beyond its initial discovery. ESET identified several artifacts linked to Asin, including a sample uploaded to VirusTotal from Türkiye in October 2025. Another malicious Android package was downloaded from the domain c-pdf[.]net in December 2025 by a user operating a Xiaomi Redmi Note 13 Pro running Android 15.

Researchers also revealed a separate application disguised as Syria Defense Map. That sample was detected on a Xiaomi Redmi Note 13 Pro+ 5G device using Android 15 around mid-January 2026. In that case, the application was reportedly obtained through the website syriadefensemap[.]com.

As with many Android threats distributed outside official app marketplaces, users must manually install the software before it can operate. The spyware also relies on victims granting requested permissions, which can provide access to sensitive information stored on the device.

ESET has not attributed the activity to any known threat group, and the purpose behind the operation remains uncertain. However, the themes used throughout the campaign provide some indication of who may have been in the attackers' sights.

The company noted that three of the fraudulent applications, GovLens, WarMap, and Syria Defense Map, appear particularly relevant to individuals involved in open-source intelligence (OSINT) research. Because the applications focused on news gathering, conflict tracking, and investigative information, researchers believe Arabic-speaking journalists and OSINT practitioners may have been among the intended targets.

The findings illustrate how threat actors continue to package malicious code within applications that appear credible and useful. By exploiting interest in current events, government information, and conflict monitoring, attackers increase the likelihood that users will install software capable of collecting data from their devices without raising immediate suspicion. 

Read more »
SafeBreach
Android Data Breach Gemini Google notifications SafeBreach

Researchers Show How Android Notifications Could Be Used to Manipulate Google Gemini

 





Security researchers have disclosed a now-remediated flaw that could have allowed specially crafted notifications from common messaging and social networking applications to influence the behavior of Google Gemini on Android devices.

The research was conducted by SafeBreach researcher Or Yair, who found that Gemini's ability to access and process notifications could be abused to deliver hidden instructions through otherwise legitimate messages. According to the findings, the technique did not rely on malware or a rogue application being installed on a target device. Instead, any service capable of sending a notification, including WhatsApp, Slack, Signal, Instagram, Messenger, or SMS, could potentially be used to deliver malicious content.

The study builds on SafeBreach's earlier "Invitation Is All You Need" research, which demonstrated how malicious Google Calendar invitations could manipulate Gemini through indirect prompt injection. Following that disclosure, Google introduced new safeguards designed to prevent external content from influencing sensitive actions. Yair's latest work examined whether similar manipulation could still occur through a different source of user data.

At the center of the issue was Gemini's Utilities feature on Android. The functionality allows the assistant to read, manage, and respond to notifications from connected applications. Researchers found that under certain circumstances, notification text could be interpreted not only as information but also as instructions that influenced the assistant's responses and actions.

Because the feature is available on Android devices and not through Gemini's web version or iOS implementation, the attack scenario was limited to Android users who had granted Gemini access to notifications.

According to SafeBreach, the number of potential entry points was unusually large because notifications can originate from countless applications and online services. This meant attackers would not necessarily need direct access to a device. Delivering a crafted notification could be sufficient to introduce malicious instructions into Gemini's processing workflow.

One of the simpler demonstrations involved altering the information Gemini presented to users. Researchers showed that manipulated notifications could cause the assistant to relay fabricated messages while making them appear to originate from legitimate contacts. In some scenarios, Gemini could process real notifications first and then attribute attacker-controlled content to an actual sender already present in the notification queue.

The researchers noted that this type of deception could be particularly effective when users interact with Gemini through voice. For example, someone driving a vehicle may hear a message that appears to come from a manager, colleague, or trusted contact and have little opportunity to verify the information displayed on the screen.

The research also examined Google's post-Calendar security protections. According to Yair, Gemini included mechanisms intended to prevent sensitive actions from being triggered without proper authorization. These checks evaluated both the user's response and the assistant's preceding output to determine whether a requested action was consistent with the conversation.

During testing, direct attempts to inject hidden commands were repeatedly blocked. To overcome these restrictions, Yair developed a technique called "Fake Context Alignment," which sought to make a user's approval appear valid to Gemini's authorization system while obscuring the true request from the user.

One variation involved displaying a sensitive authorization prompt in a language unfamiliar to the victim. Researchers used an example where a request such as "Do you want to open the window?" appeared in Chinese while a harmless English-language question followed. If the user responded with "Yes," Gemini could potentially associate that response with the hidden authorization request rather than the visible conversation.

A second technique relied on differences between information displayed on-screen and information spoken aloud by Gemini's text-to-speech system. Researchers found that certain hidden content embedded within hyperlinks might not be read aloud. In a demonstration, the visible interface contained a sensitive authorization request while the spoken response presented a routine message, increasing the likelihood that a user would unknowingly approve an action.

SafeBreach reported that combining these techniques increased the chances of bypassing the authorization safeguards that Google had introduced after the earlier Calendar-based attack research.

Once authorization was obtained, the researchers demonstrated several potential outcomes. Through integrations with Google Home, Gemini could interact with connected smart-home devices, including windows, lighting systems, and boilers. Additional demonstrations involved opening websites that could expose a user's approximate location through IP address information or trigger file downloads.

The research also explored interactions with third-party applications. In one proof-of-concept scenario, Gemini followed a trusted web address that later redirected to a Zoom link, resulting in the device joining an online meeting. SafeBreach emphasized that this occurred within a controlled testing environment and stated that its own public domain was not configured to redirect users to Zoom. Instead, the redirect was performed through a local test server used during the demonstration.

Researchers additionally identified a persistence mechanism involving Gemini's memory capabilities. Unlike the earlier Calendar-based research, the notification technique enabled the assistant to store attacker-controlled information as long-term memory. In one demonstration, Gemini was persuaded to remember an incorrect name for the user. Because memory is associated with a Google account rather than a single device, inaccurate information could potentially appear wherever that account later accessed Gemini.

The study also demonstrated the creation of recurring automated tasks. Researchers showed that instructions could potentially be scheduled to execute repeatedly, including examples involving regular access to recent messages at specific times.

SafeBreach disclosed the findings to Google's Vulnerability Reward Program on August 17, 2025. Google classified the report as a high-priority issue and later confirmed that changes to its content-classification systems mitigated both the notification-based prompt injection technique and the related authorization bypass method. The company confirmed the remediation on November 14, 2025.

No CVE identifier was assigned to the issue, and SafeBreach stated that it found no evidence indicating the technique had been exploited in real-world attacks before the fixes were implemented.

Because Google's mitigation was deployed through server-side updates, users did not need to install a software update to receive protection. However, individuals seeking additional safeguards can restrict Gemini's access to notifications by disabling the Utilities feature through Connected Apps settings or by revoking the Google app's notification-reading permissions on Android.

The findings provide another example of the security challenges that emerge as AI assistants gain access to messages, notifications, calendars, and connected services. As these systems become increasingly capable of performing actions on behalf of users, researchers continue to examine how external content can influence AI-driven decision-making and whether existing safeguards are sufficient to prevent misuse.

Read more »
Software
Android App Developers Apple Apps Google Google Play malware Software

Google Rolls Out Android Developer Verification to Curb Anonymous App Distribution

 



Google has formally begun rolling out a comprehensive verification framework for Android developers, a move aimed at tackling the persistent problem of malicious applications being distributed by actors who operate without revealing their identity. The company’s decision reflects growing concerns within the mobile ecosystem, where anonymity has often enabled bad actors to bypass accountability and circulate harmful software at scale.

This rollout comes in advance of a stricter compliance requirement that will first take effect in September across key markets including Brazil, Indonesia, Singapore, and Thailand. These regions are being used as initial enforcement zones before the policy is gradually expanded worldwide next year, signaling Google’s intent to standardize developer accountability across its global Android ecosystem.

Under the new system, developers who distribute Android applications outside of the official Google Play marketplace will now be required to register through the Android Developer Console and verify their identity credentials. This requirement is particularly substantial for developers who rely on alternative distribution methods such as direct APK sharing, enterprise deployment, or third-party app stores, as it introduces a layer of traceability that previously did not exist.

At the same time, Google clarified that developers already publishing applications through Google Play and who have completed existing identity verification processes may not need to take further action. In such cases, their applications are likely to already comply with the updated requirements, reducing friction for those operating within the official ecosystem.

Explaining how this change will affect end users, Matthew Forsythe, Director of Product Management for Android App Safety, emphasized that the vast majority of users will not notice any difference in their day-to-day app installation experience. Standard app downloads from trusted sources will continue to function as usual, ensuring that usability is not compromised for the general public.

However, the experience changes when a user attempts to install an application that has not been registered under the new verification system. In such cases, users will be required to proceed through more advanced installation pathways, such as Android Debug Bridge or similar technical workflows. These methods are typically used by developers and experienced users, which effectively limits exposure for less technical individuals.

This design introduces a deliberate separation between general users and advanced users. While everyday users are shielded from potentially unsafe applications, power users retain the flexibility to install software manually, albeit with additional steps that reinforce intentional decision-making.

To further support developers, Google is integrating visibility into its core development tools. Within the next two months, developers using Android Studio will be able to directly view whether their applications are registered under the new system at the time of generating signed App Bundles or APK files. This integration ensures that compliance status becomes part of the development workflow rather than a separate administrative task.

For developers who have already completed identity verification through the Play Console, Google will automatically register eligible applications under the new framework. This automation reduces operational overhead and ensures a smoother transition. However, in cases where applications cannot be automatically registered, developers will be required to complete a manual claim process to verify ownership and bring those apps into compliance.

In earlier guidance, Google also outlined how sideloading, the practice of installing apps from outside official stores, will function under this system. Advanced users will still be able to install unregistered APK files, but only after completing a multi-step verification process designed to confirm their intent.

This process includes an authentication step to verify the user’s decision, followed by a one-time waiting period of up to 24 hours. The delay is not arbitrary. It is specifically designed to disrupt scam scenarios in which attackers pressure users into quickly installing malicious applications before they have time to reconsider.

Forsythe explained that although this process is required only once for experienced users, it has been carefully structured to counter high-pressure social engineering tactics. By introducing friction into the installation process, the system aims to reduce the success rate of scams that rely on urgency and manipulation.

This development is part of a wider industry tendency toward tightening control over app ecosystems and improving user data protection. In a parallel move, Apple has recently updated its Developer Program License Agreement to impose stricter rules on how third-party wearable applications handle sensitive data such as live activity updates and notifications.

Under Apple’s revised policies, developers are explicitly prohibited from using forwarded data for purposes such as advertising, user profiling, training machine learning models, or tracking user location. These restrictions are intended to prevent misuse of real-time user data beyond its original functional purpose.

Additionally, developers are not allowed to share this forwarded information with other applications or devices, except for authorized accessories that are explicitly approved within Apple’s ecosystem. This ensures tighter control over how data flows between devices.

The updated agreement also introduces further limitations. Developers are barred from storing this data on external cloud servers, altering its meaning in ways that change the original content, or decrypting the information anywhere other than on the designated accessory device. These measures collectively aim to preserve data integrity and minimize the risk of misuse.

Taken together, this charts a new course across the technology industry toward stronger governance of developer behavior, application distribution, and data handling practices. As threats such as malware distribution, financial fraud, and data exploitation continue to evolve, platform providers are increasingly prioritizing transparency, accountability, and user protection in their security strategies.

Read more »
malware
Android Anthropic Artificial Inteligence Firefox malware

Anthropic AI Model Finds 22 Security Flaws in Firefox

 

Anthropic said its artificial intelligence model Claude Opus 4.6 helped uncover 22 previously unknown security vulnerabilities in the Firefox web browser as part of a collaboration with the Mozilla. 

The company said the issues were discovered during a two week analysis conducted in January 2026. 

The findings include 14 vulnerabilities rated as high severity, seven categorized as moderate and one considered low severity. 

Most of the flaws were addressed in Firefox version 148, which was released late last month, while the remaining fixes are expected in upcoming updates. 

Anthropic said the number of high severity bugs discovered by its AI model represents a notable share of the browser’s serious vulnerabilities reported over the past year. 

During the research, Claude Opus 4.6 scanned roughly 6,000 C++ files in the Firefox codebase and generated 112 unique vulnerability reports. 

Human researchers reviewed the results to confirm the findings and rule out false positives before reporting them. One issue identified by the model involved a use-after-free vulnerability in Firefox’s JavaScript engine. 

According to Anthropic, the AI located the flaw within about 20 minutes of examining the code, after which a security researcher validated the finding in a controlled testing environment. 

Researchers also tested whether the AI model could go beyond identifying flaws and attempt to build exploits from them. Anthropic said it provided Claude access to the list of vulnerabilities reported to Mozilla and asked it to develop working exploits. 

After hundreds of test runs and about $4,000 worth of API usage, the model succeeded in producing a working exploit in only two cases. 

Anthropic said the results suggest that finding vulnerabilities may be easier for AI systems than turning those flaws into functioning exploits. 

“However, the fact that Claude could succeed at automatically developing a crude browser exploit, even if only in a few cases, is concerning,” the company said. 

It added that the exploit tests were performed in a restricted research environment where some protections, such as sandboxing, were deliberately removed. 

One exploit generated by the model targeted a vulnerability tracked as CVE-2026-2796, which involves a miscompilation issue in the JavaScript WebAssembly component of Firefox’s just-in-time compilation system. 

Anthropic said the testing process included a verification system designed to check whether the AI-generated exploit actually worked. 

The system provided real-time feedback, allowing the model to refine its attempts until it produced a functioning proof of concept. The research comes shortly after Anthropic introduced Claude Code Security in a limited preview. 

The tool is designed to help developers identify and fix software vulnerabilities with the assistance of AI agents. Mozilla said in a separate statement that the collaboration produced additional findings beyond the 22 vulnerabilities. 

According to the company, the AI-assisted analysis uncovered about 90 other bugs, including assertion failures typically identified through fuzzing as well as logic errors that traditional testing tools had missed. 

“The scale of findings reflects the power of combining rigorous engineering with new analysis tools for continuous improvement,” Mozilla said. 

“We view this as clear evidence that large-scale, AI-assisted analysis is a powerful new addition to security engineers’ toolbox.”
Read more »
social engineering attacks
Android Android Spyware Cloud Infrastructure Abuse Hugging Face Abuse malware Mobile Credential Theft Mobile Security Threats Remote Access Trojan social engineering attacks

Threat Actors Leverage Hugging Face to Spread Android Malware at Scale


 

Initially appearing as a routine security warning for mobile devices, this warning has evolved into a carefully engineered malware distribution pipeline. Researchers at Bitdefender have identified an Android campaign utilizing counterfeit security applications that serve as the first stage droppers for remote access Trojans, known as TrustBastion. 

The operators have opted not to rely on traditional malware hosting infrastructure, but have incorporated their delivery mechanism into Hugging Face's public platform, allowing it to conceal malicious activity through its reputation and traffic profile. 

Social engineering is used to drive the infection chain, with deceptive ads and fabricated threat alerts causing users to install the malware. The app silently retrieves a secondary payload from Hugging Face once it has been installed on the device, providing persistence via extensive permission abuse. 

At scale, the campaign is distinguished by a high degree of automation, resulting in thousands of distinct Android package variants, thereby evading signature-based detection and complicating attribution, thus demonstrating the shift toward a more industrialized approach to mobile malware. 

Using this initial foothold as a starting point, the campaign illustrates how trusted developer infrastructure can be repurposed to support a large-scale theft of mobile credentials. As a consequence, threat actors have been using Hugging Face as a distribution channel for thousands of distinct Android application packages that were designed to obtain credentials related to widely used financial, banking, and digital payment services.

Generally, Hugging Face is regarded as a low-risk domain, meaning that automated security controls and suspicion from users are less likely to be triggered by this site's hosting and distribution of artificial intelligence, natural language processing, and machine learning models.

Despite the fact that the platform has previously been abused to host malicious AI artifacts, Bitdefender researchers point out that its exploitation as a delivery channel for Android malware constitutes an intentional attempt to disguise the payload as legitimate development traffic. It has been determined that the infection sequence begins with the installation of an application disguised as a mobile security solution known as TrustBastion. 

Using scareware-style advertisements, the app presents fake warnings claiming that the device has been compromised, urging immediate installation to resolve alleged threats, including phishing attempts, fraudulent text messages, and malware. 

Upon deployment, the application displays a mandatory update prompt which is closely similar to that of Google Play, thereby reinforcing the illusion of legitimacy. In lieu of embedding malicious code directly, the dropper contacts infrastructure associated with the trustbastion[.]com domain, which redirects the user to a repository containing Hugging Face datasets. 

After retrieving the final malicious APK via Hugging Face's content delivery network, the attackers complete a staged payload delivery process that complicates detection and allows them to continuously rotate malware variants with minimal operational overhead, complicating detection. This stage demonstrates why Hugging Face was purposefully integrated into the attacker's delivery chain during this phase of the operation. 

It is common for security controls to flag traffic from newly registered or low-reputation domains quickly, causing threat actors to route malicious activity through well-established platforms that blend into normal network behavior, resulting in the use of well-established platforms.

TrustBastion droppers are not designed to retrieve spyware directly from attacker-controlled infrastructure in this campaign. Rather than hosting the malware itself, it initiates a request to a website associated with the trustbastion[. ]com domain, which serves as an intermediary rather than as a hosting point for it.

The server response does not immediately deliver a malicious application package. The server returns a HTML resource that contains a redirect link to a Hugging Face repository where the actual malware can be found. By separating the initial contact point from the final malware host, the attackers introduce additional indirection, which makes static analysis and takedown efforts more challenging. 

According to Bitdefender, the malicious datasets were removed after being notified by Hugging Face before publication of its findings. Telemetry indicates the campaign had already reached a significant number of victims before the infrastructure was dismantled, despite the swift response. Furthermore, analysis of the repositories revealed unusually high levels of activity over a short period of time. 

A single repository accumulated over 6,000 commits within a month, indicating that it was fully automated. A new payload was generated and committed approximately every 15 minutes, according to Bitdefender. A number of repositories were taken offline during the campaign, but the campaign displayed resilience by reappearing under alternative redirect links, using the same core codebase and only minor cosmetic changes to the icons and application metadata. 

The operators further undermined traditional defense effectiveness by utilizing polymorphic techniques throughout the payloads they used. The uploaded APKs were freshly constructed, retaining identical malicious capabilities while introducing small structural changes intended to defeat hash-based detection. 

It was noted by Bitdefender that this approach increased evasion against signature-driven tools, but that the malware variants maintained consistent behavioral patterns, permission requests, and network communication traits, which made them more susceptible to behavioral and heuristic analysis in the future. 

After installation, the malware presents itself as a benign "Phone Security" feature and guides users through the process of enabling Android Accessibility Services. This step allows the remote access trojan to obtain extensive information about user activity and on-screen activity. In order to monitor activity in real time, capture sensitive screen content, and relay information to the malware's command and control servers, additional permissions are requested. 

By impersonating legitimate financial and payment applications, such as Alipay and WeChat, this malware enhances the threat. By intercepting credentials and collecting lock-screen verification information, it becomes a full-spectrum tool to collect credentials and spy on mobile devices. 

In a defensive perspective, this campaign reminds us that trust in popular platforms can be strategically exploited if security assumptions are not challenged. By combining legitimate developer infrastructure abuse with high levels of automation and polymorphic payload generation, traditional indicators alone cannot detect these types of attacks. 

For Bitdefender's users, the findings reinforce the importance of identifying such threats earlier in the infection chain through behavioral analysis, permission monitoring, and anomaly-based network inspection. Users are advised to take precautions when responding to unsolicited security alerts or applications requesting extensive system privileges based on the findings.

Additionally, the operation highlights the growing adoption of cloud-native distribution models by malicious mobile malware actors, emphasizing the importance of platform providers, security vendors, and enterprises collaborating more closely to monitor abuse patterns and respond quickly to emerging misuses of trusted ecosystems.
Read more »
zero click
Android Apple Cyber Security Google iPhone Meta Spyware zero click

What Happens When Spyware Hits a Phone and How to Stay Safe

 



Although advanced spyware attacks do not affect most smartphone users, cybersecurity researchers stress that awareness is essential as these tools continue to spread globally. Even individuals who are not public figures are advised to remain cautious.

In December, hundreds of iPhone and Android users received official threat alerts stating that their devices had been targeted by spyware. Shortly after these notifications, Apple and Google released security patches addressing vulnerabilities that experts believe were exploited to install the malware on a small number of phones.

Spyware poses an extreme risk because it allows attackers to monitor nearly every activity on a smartphone. This includes access to calls, messages, keystrokes, screenshots, notifications, and even encrypted platforms such as WhatsApp and Signal. Despite its intrusive capabilities, spyware is usually deployed in targeted operations against journalists, political figures, activists, and business leaders in sensitive industries.

High-profile cases have demonstrated the seriousness of these attacks. Former Amazon chief executive Jeff Bezos and Hanan Elatr, the wife of murdered Saudi dissident Jamal Khashoggi, were both compromised through Pegasus spyware developed by the NSO Group. These incidents illustrate how personal data can be accessed without user awareness.

Spyware activity remains concentrated within these circles, but researchers suggest its reach may be expanding. In early December, Google issued threat notifications and disclosed findings showing that an exploit chain had been used to silently install Predator spyware. Around the same time, the U.S. Cybersecurity and Infrastructure Security Agency warned that attackers were actively exploiting mobile messaging applications using commercial surveillance tools.

One of the most dangerous techniques involved is known as a zero-click attack. In such cases, a device can be infected without the user clicking a link, opening a message, or downloading a file. According to Malwarebytes researcher Pieter Arntz, once infected, attackers can read messages, track keystrokes, capture screenshots, monitor notifications, and access banking applications. Rocky Cole of iVerify adds that spyware can also extract emails and texts, steal credentials, send messages, and access cloud accounts.

Spyware may also spread through malicious links, fake applications, infected images, browser vulnerabilities, or harmful browser extensions. Recorded Future’s Richard LaTulip notes that recent research into malicious extensions shows how tools that appear harmless can function as surveillance mechanisms. These methods, often associated with nation-state actors, are designed to remain hidden and persistent.

Governments and spyware vendors frequently claim such tools are used only for law enforcement or national security. However, Amnesty International researcher Rebecca White states that journalists, activists, and others have been unlawfully targeted worldwide, using spyware as a method of repression. Thai activist Niraphorn Onnkhaow was targeted multiple times during pro-democracy protests between 2020 and 2021, eventually withdrawing from activism due to fears her data could be misused.

Detecting spyware is challenging. Devices may show subtle signs such as overheating, performance issues, or unexpected camera or microphone activation. Official threat alerts from Apple, Google, or Meta should be treated seriously. Leaked private information can also indicate compromise.

To reduce risk, Apple offers Lockdown Mode, which limits certain functions to reduce attack surfaces. Apple security executive Ivan Krstić states that widespread iPhone malware has not been observed outside mercenary spyware campaigns. Apple has also introduced Memory Integrity Enforcement, an always-on protection designed to block memory-based exploits.

Google provides Advanced Protection for Android, enhanced in Android 16 with intrusion logging, USB safeguards, and network restrictions.

Experts recommend avoiding unknown links, limiting app installations, keeping devices updated, avoiding sideloading, and restarting phones periodically. However, confirmed infections often require replacing the device entirely. Organizations such as Amnesty International, Access Now, and Reporters Without Borders offer assistance to individuals who believe they have been targeted.

Security specialists advise staying cautious without allowing fear to disrupt normal device use.

Read more »
malware
Aisuru Android Botnets IP Address malware

Researchers Disrupt Major Botnet Network After It Infects Millions of Android Devices

 


Security researchers have dismantled a substantial portion of the infrastructure powering the Kimwolf and Aisuru botnets, cutting off communication to more than 550 command-and-control servers used to manage infected devices. The action was carried out by Black Lotus Labs, the threat intelligence division of Lumen Technologies, and began in early October 2025.

Kimwolf and Aisuru operate as large-scale botnets, networks of compromised devices that can be remotely controlled by attackers. These botnets have been used to launch distributed denial-of-service attacks and to route internet traffic through infected devices, effectively turning them into unauthorized residential proxy nodes.

Kimwolf primarily targets Android systems, with a heavy concentration on unsanctioned Android TV boxes and streaming devices. Prior technical analysis showed that the malware is delivered through a component known as ByteConnect, which may be installed directly or bundled into applications that come preloaded on certain devices. Once active, the malware establishes persistent access to the device.

Researchers estimate that more than two million Android devices have been compromised. A key factor enabling this spread is the exposure of Android Debug Bridge services to the internet. When left unsecured, this interface allows attackers to install malware remotely without user interaction, enabling rapid and large-scale infection.

Follow-up investigations revealed that operators associated with Kimwolf attempted to monetize the botnet by selling access to the infected devices’ internet connections. Proxy bandwidth linked to compromised systems was offered for sale, allowing buyers to route traffic through residential IP addresses in exchange for payment.

Black Lotus Labs traced parts of the Aisuru backend to residential SSH connections originating from Canadian IP addresses. These connections were used to access additional servers through proxy infrastructure, masking malicious activity behind ordinary household networks. One domain tied to this activity briefly appeared among Cloudflare’s most accessed domains before being removed due to abuse concerns.

In early October, researchers identified another Kimwolf command domain hosted on infrastructure linked to a U.S.-based hosting provider. Shortly after, independent reporting connected multiple proxy services to a now-defunct Discord server used to advertise residential proxy access. Individuals associated with the hosting operation were reportedly active on the server for an extended period.

During the same period, researchers observed a sharp increase in Kimwolf infections. Within days, hundreds of thousands of new devices were added to the botnet, with many of them immediately listed for sale through a single residential proxy service.

Further analysis showed that Kimwolf infrastructure actively scanned proxy services for vulnerable internal devices. By exploiting configuration flaws in these networks, the malware was able to move laterally, infect additional systems, and convert them into proxy nodes that were then resold.

Separate research uncovered a related proxy network built from hundreds of compromised home routers operating across Russian internet service providers. Identical configurations and access patterns indicated automated exploitation at scale. Because these devices appear as legitimate residential endpoints, malicious traffic routed through them is difficult to distinguish from normal consumer activity.

Researchers warn that the abuse of everyday consumer devices continues to provide attackers with resilient, low-visibility infrastructure that complicates detection and response efforts across the internet.

Read more »
Technology
Android app pinning guided access iphone iPhone lock apps phone snooping smartphone privacy Technology

This Built-In Android and iPhone Feature Lets You Share Your Phone Safely

 


Handing your phone to someone, even briefly, can expose far more than intended. Whether it is to share a photo, allow a quick call, or let a child watch a video, unrestricted access can put personal data at risk. To address this, both Android and iPhone offer built-in privacy features that limit access to a single app. Android calls this App Pinning, while Apple uses "Guided Access", allowing you to share your screen safely while keeping the rest of your phone locked.

Your smartphone holds far more than just apps. It contains banking details, private messages, location history, emails, and photos you may not want others to see. Even a quick glance at your home screen can reveal which banks you use or who you communicate with. This is why unrestricted access, even for a moment, can put your privacy and identity at risk. Handing over your phone without restrictions—especially to a stranger—is never a good idea.

There are many everyday situations where this feature becomes useful. A child may want to watch a YouTube video, but you do not want them opening emails or messages. A stranger may need to make a call in an emergency, but nothing beyond that. Even a friend doing a quick Google search does not need access to your search history or other apps. App Pinning and "Guided Access" make sure the phone stays exactly where you want it.

On Android, enabling App Pinning is simple. Head to Settings, search for “App Pinning,” and turn it on. Make sure authentication is required to exit the pinned app. Once enabled, open the app you want to share, go to the recent apps view, tap the app icon, and select Pin. The phone will stay locked to that app until you authenticate. To exit, swipe up and hold, then unlock using your PIN, password, or biometrics.

iPhone users can achieve the same result using "Guided Access". This feature lives under Settings → Accessibility. After setup, it can be activated by triple-clicking the power button. Open the app you want to share, triple-click the power button, and hand over the phone. When finished, triple-click again and authenticate with Face ID, Touch ID, or a passcode to return to normal use.

One limitation exists when sharing photos on both platforms. If you pin the Photos app, the other person can still swipe through your gallery. On iOS, this can be fixed by disabling touch input from the "Session Settings" menu when starting "Guided Access". Android, however, does not currently allow disabling touch during App Pinning, which means extra caution is needed when sharing photos.

The takeaway is simple: never hand your phone to someone without locking it to a single app first. App Pinning on Android and "Guided Access" on iOS are easy to use and extremely effective at protecting your privacy, keeping prying eyes away from your personal data.
Read more »
Technology
Android Artificial Intelligence Contextual AI Google Google Pixel Technology

Google Testing ‘Contextual Suggestions’ Feature for Wider Android Rollout

 



Google is reportedly preparing to extend a smart assistance feature beyond its Pixel smartphones to the wider Android ecosystem. The functionality, referred to as Contextual Suggestions, closely resembles Magic Cue, a software feature currently limited to Google’s Pixel 10 lineup. Early signs suggest the company is testing whether this experience can work reliably across a broader range of Android devices.

Contextual Suggestions is designed to make everyday phone interactions more efficient by offering timely prompts based on a user’s regular habits. Instead of requiring users to manually open apps or repeat the same steps, the system aims to anticipate what action might be useful at a given moment. For example, if someone regularly listens to a specific playlist during workouts, their phone may suggest that music when they arrive at the gym. Similarly, users who cast sports content to a television at the same time every week may receive an automatic casting suggestion at that familiar hour.

According to Google’s feature description, these suggestions are generated using activity patterns and location signals collected directly on the device. This information is stored within a protected, encrypted environment on the phone itself. Google states that the data never leaves the device, is not shared with apps, and is not accessible to the company unless the user explicitly chooses to share it for purposes such as submitting a bug report.

Within this encrypted space, on-device artificial intelligence analyzes usage behavior to identify recurring routines and predict actions that may be helpful. While apps and system services can present the resulting suggestions, they do not gain access to the underlying data used to produce them. Only the prediction is exposed, not the personal information behind it.

Privacy controls are a central part of the feature’s design. Contextual data is automatically deleted after 60 days by default, and users can remove it sooner through a “Manage your data” option. The entire feature can also be disabled for those who prefer not to receive contextual prompts at all.

Contextual Suggestions has begun appearing for a limited number of users running the latest beta version of Google Play Services, although access remains inconsistent even among beta testers. This indicates that the feature is still under controlled testing rather than a full rollout. When available, it appears under Settings > Google or Google Services > All Services > Others.

Google has not yet clarified which apps support Contextual Suggestions. Based on current observations, functionality may be restricted to system-level or Google-owned apps, though this has not been confirmed. The company also mentions the use of artificial intelligence but has not specified whether older or less powerful devices will be excluded due to hardware limitations.

As testing continues, further details are expected to emerge regarding compatibility, app support, and wider availability. For now, Contextual Suggestions reflects Google’s effort to balance convenience with on-device privacy, while cautiously evaluating how such features perform across the diverse Android ecosystem.

Read more »
Subscribe to: Posts (Atom)