Tag: mobile
26 entries tagged mobile, latest activity first.
- Sekoia: an APT29-linked watering hole serves n-day iOS and Android exploit chains through compromised sites, clone domains and a one-week compromise of the Plerdy tracker; CISA lists the Apple WebKit pointer-authentication bypass CVE-2024-27834 as exploited on 2026-11-04
- Android telephony ('SMS of Death'): one hidden WAP Push message crashes the phone process and drops calls, emergency calls included; fixed for Android 14 to 17 in the October 2026 update according to the researcher, Android 12 and 13 stay exposed, public proof of concept
- DeadTag: re-registered domains of defunct analytics and advertising tags redirect visitors of thousands of sites, among them to a page that serves the Coruna and DarkSword iPhone exploit kits, which compromise a vulnerable device when the page opens
- CVE-2026-86950, Apple iOS, iPadOS and macOS CoreGraphics: out-of-bounds write exploited in an extremely sophisticated attack on targeted iOS users, CISA KEV-listed (CVSS 8.8)
- AdFection: Citizen Lab and Confiant document zero-click Candiru spyware delivered through targeted online ads from the ad-tech firm Discover-Tech, with ad impressions on defence-ministry, armed-forces and NATO networks
- CVE-2026-58704: Google Pixel zero-click privilege escalation out of the cellular modem sandbox, listed in CISA KEV as exploited
- WeWorm: an AI-assisted zero-click worm demonstrates full WeChat account takeover on Android and iOS from a single unanswered call
- WindRelay, a purpose-built Android NFC-relay malware installed silently by a companion remote-access trojan during the fraud call itself, with per-victim app names carrying the victim's own name
- CERT-UA: Sandworm subcluster UAC-0145 pairs ClickFix fake-CAPTCHA with Ethereum-smart-contract C2 resolution and a Signal-delivered Android backdoor
- RedHook Android RAT abuses ADB Wireless Debugging to self-grant shell (uid 2000) privileges without an exploit
- ESET Threat Report H1 2026: first Android malware using generative AI at runtime, ClickFix detections more than double, record QR-phishing, 100+ EDR-killers
- Citizen Lab: a European Parliament spyware-inquiry member was himself infected twice with Pegasus
- FBI/CISA: Russian intelligence now phishing Signal Backup Recovery Keys for persistent account takeover
- Citizen Lab: Cellebrite UFED used by Russian authorities three months after the vendor's Russia pull-out
- usbliter8, a permanent SecureROM boot-chain exploit for Apple A12/A13 silicon
- Zimperium: Rokarolla Android banking trojan targets 217 apps with full device takeover
- Meta files contempt complaint against NSO Group over fresh WhatsApp spyware phishing
- FIFA World Cup 2026 pre-event threat cluster: Android banking trojans in pirated streaming apps, plus a 13,000-domain fraud layer, ahead of the 11 June kick-off
- Enclave: a single debug flag left on in six Microsoft 365 Android apps allowed silent OAuth-token theft
- CVE-2025-48595, Android Framework: actively-exploited integer-overflow privilege escalation
- Italy's low-cost commercial spyware economy: Accessibility-API abuse as the cheap alternative to zero-days
- "Signal Support" impersonation phishing harvests cloud-backup recovery keys from high-value users
- WatchGuard documents Grandoreiro's Delphi-DLL-side-loading + WebSocket/STUN C2 against Portuguese & Spanish banks; ESET maps parallel Android BTMOB MaaS
- Wiz CIRT names JINX-0164, LinkedIn-recruiter lures, AUDIOFIX macOS infostealer, MINIRAT npm pivot into CI/CD
- TrickMo C: Android banking trojan moves its C2 onto The Open Network and turns infected phones into SOCKS5 and SSH network pivots
- SMS-blaster smishing in Switzerland: fake base stations push phones onto 2G and send spoofed texts past operator filters