android

Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

, ,

Researchers unveiled vulnerabilities in five open-source Android AI agent frameworks, demonstrating how invisible screen text can be injected and leveraged to execute arbitrary commands on the host PC via insecure interactions like unsanitized shell calls and file race conditions. These attacks exploit weaknesses such as unprotected broadcast inputs, overlay UI spoofing, and lack of keyboard input authentication, enabling remote code execution without user detection; despite private disclosure, the maintainers have yet to respond or patch the issues, underscoring the need for improved security practices in mobile AI agent tooling.

https://thehackernews.com/2026/07/open-source-android-ai-agents-could-let.html

Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking

, ,

A study analyzing 281 free Android VPN apps from the Google Play Store found widespread security failures, including traffic leaks, unencrypted data transmission, and extensive user tracking, affecting apps with over 2.4 billion installs. The researchers identified serious vulnerabilities like tunnel hijacking and DNS leaks, with many apps failing to encrypt configuration files or disguising VPN traffic, while most also connected to known tracking servers, compromising user privacy despite VPN claims. The findings underscore persistent weak engineering in free VPN apps and highlight the importance of trusting reputable providers with proven security audits.

https://thehackernews.com/2026/07/study-of-281-free-android-vpn-apps.html

Microsoft 365 Android Apps Account Takeover Vulnerability Impacted Billions of Android Users

, , ,

A critical vulnerability called FlagLeft was discovered in six major Microsoft 365 Android apps, where a debug flag left enabled in production allowed any app on the device to silently obtain valid Microsoft account tokens without user consent. This flaw exposed billions of users to account takeover risks, enabling attackers to access emails, files, and calendar data under the victim's identity; Microsoft has since patched the issue and urged users to update affected apps immediately.

https://cybersecuritynews.com/microsoft-365-android-apps-account-takeover-vulnerability/

Google Blocked Over 1.75 Million Play Store App Submissions in 2025

, ,

Google blocked over 1.75 million Play Store app submissions in 2025 due to policy violations, enhancing app security. They implemented 10,000 safety checks, identified malicious patterns using AI, and banned 80,000 bad developer accounts. Additionally, Play Protect scanned over 350 billion apps, identifying millions of risks, while new protections against fraudulent activities were added. Google continues to invest in AI for future app safety.

https://www.bleepingcomputer.com/news/security/google-blocked-over-175-million-play-store-app-submissions-in-2025/

Android Malware Taps Gemini to Navigate Infected Devices

, , , ,

Android malware named PromptSpy employs generative AI (Gemini) for adaptive navigation on infected devices. It mainly functions to deploy remote access via VNC, utilizing natural language prompts to interact with user interfaces, enhancing the malware's versatility across different devices. Developed by Chinese speakers, PromptSpy is still largely theoretical, with no live telemetry reports from ESET, but suspected distribution domains hint at potential real-world application. The malware can intercept security codes, record screens, and prevent uninstallation, indicating a disturbing evolution in Android threats.

https://www.theregister.com/2026/02/19/genai_malware_android/

New Android Malware Uses AI to Click on Hidden Browser Ads

, , ,

New Android malware utilizes AI with TensorFlow to automatically click on hidden ads, enhancing click fraud mechanisms. Distributed via Xiaomi’s app store and third-party sites, it uses a ‘phantom’ mode for covert actions and a ‘signalling’ mode for real-time control. Affected apps initially lack malicious intent but receive updates adding harmful features, misleading users. Users are advised to avoid non-Google Play apps to mitigate risks.

https://www.bleepingcomputer.com/news/security/new-android-malware-uses-ai-to-click-on-hidden-browser-ads/

Android Mobile Adware Surges in Second Half of 2025

, , ,

Android adware surged in late 2025, with detections nearly doubling and malicious threats becoming more organized. Cybercriminals shifted from simple scams to sophisticated frameworks, employing tools like MobiDash and Triada for ongoing data theft and fraud. Users should prioritize mobile security by using trusted app stores, scrutinizing permissions, avoiding sideloaded apps, and employing real-time security software.

https://www.malwarebytes.com/blog/mobile/2025/12/android-threats-in-2025-when-your-phone-becomes-the-main-attack-surface

New DroidLock Malware Locks Android Devices and Demands a Ransom

,

New DroidLock malware targets Android users, locks screens for ransom, and can access personal data. It spreads via fake apps, gaining permissions to control devices. It can wipe data, change passwords, and threaten file destruction. Android users are advised to avoid sideloading apps and check permissions.

https://www.bleepingcomputer.com/news/security/new-droidlock-malware-locks-android-devices-and-demands-a-ransom/

New Android Malware Lets Criminals Control Your Phone and Drain Your Bank Account

, ,

New Android malware, Albiriox, allows attackers remote control of infected phones to siphon money from bank and crypto accounts. It operates as Malware-as-a-Service (MaaS), targeting over 400 financial apps globally. Albiriox employs advanced techniques like live streaming, automated clicks, and stealth operations to evade detection, making it a significant threat. Users should only install trusted apps, verify permissions, and utilize up-to-date anti-malware solutions for protection.

https://www.malwarebytes.com/blog/news/2025/12/new-android-malware-lets-criminals-control-your-phone-and-drain-your-bank-account

CISA Warns iPhone And Android Users — Secure Your Smartphone Now

, ,

CISA and UK security agencies warn smartphone users of rising cyber threats, particularly via spyware targeting messaging apps. They recommend iPhone and Android owners immediately apply strict security measures: enable advanced device modes, use only trustworthy services, restrict app permissions, and keep devices and apps up to date. Both agencies caution against using personal VPNs due to the risk of malware and poor privacy from many VPN providers. Official app stores are the safest place to get apps. Additional advice includes using strong passwords, enabling device tracking, and avoiding unknown Wi-Fi networks unless necessary.

https://www.forbes.com/sites/daveywinder/2025/11/28/cisa-warns-iphone-and-android-users—secure-your-smartphone-now/

Breaking: Google Is Easing up on Android’s New Sideloading Restrictions!

,

Google will simplify sideloading for experienced Android users, allowing them to install unverified apps with an “advanced flow” that includes risk warnings. This follows backlash against new restrictions limiting such installations. The change aims to enhance safety while allowing user choice. Developer verification will also become mandatory to combat scams, but a lower barrier account type will be available for hobbyists.

https://www.androidauthority.com/android-power-users-install-unverified-apps-3615310/

Google to Verify All Android Developers in 4 Countries to Block Malicious Apps

Google will verify all Android developers to enhance app security, starting invitations in October 2025 and enforcement in September 2026 across Brazil, Indonesia, Singapore, and Thailand. This aims to curb malicious apps and bolster developer accountability while maintaining user choice. Existing Play Store developers may face fewer changes due to prior compliance, while new accounts will require a D-U-N-S number.

https://thehackernews.com/2025/08/google-to-verify-all-android-developers.html

Google Fixes Android Zero-days Exploited in Attacks, 60 Other Flaws

Google patched 62 Android vulnerabilities in April 2025, including two zero-days exploited in targeted attacks, one linked to a Serbian police operation using Cellebrite tools. The first zero-day (CVE-2024-53197) involved a privilege escalation in the Linux kernel's USB-audio driver. The second zero-day (CVE-2024-53150) allowed attackers access to sensitive information via an out-of-bounds read. The updates were shared with OEM partners in January, and additional security flaws were addressed in the monthly patches.

https://www.bleepingcomputer.com/news/security/google-fixes-android-zero-days-exploited-in-attacks-60-other-flaws/

Phishing Platform ‘Lucid’ Behind Wave of iOS, Android SMS Attacks

, ,

Phishing platform ‘Lucid,' operated by the XinXin group, targets 169 entities across 88 countries using iMessage and RCS for SMS attacks. Sold on a subscription model, it provides phishing domains and tools to attackers. Lucid sends 100,000 smishing messages daily, bypassing spam filters with encrypted messaging tech. The operation employs device farms and impersonates legitimate services to steal personal data, including financial information, often demonstrating ease of use through public videos.

https://www.bleepingcomputer.com/news/security/phishing-platform-lucid-behind-wave-of-ios-android-sms-attacks/

Scroll to Top