#Android
All CosmicBytez Labs articles tagged #Android, across news, security advisories, how-to guides, and projects.
- News
Google Rolls Out AI Scam Defenses for Android Messages and Calls
Google is rolling out Gemini-powered scam detection for Android Messages and call-forwarding abuse protections to eligible devices.
- News
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Bitdefender found firmware-level malware on cheap MediaTek Android phones, turning thousands of devices into ad-fraud and proxy nodes.
- News
Android's October 2026 Security Update Patches 25 Vulnerabilities, Including 7 Critical Bugs
Google's October 2026 Android patch level fixes 25 flaws across Framework and System, with seven rated critical and none exploited in the wild.
- Security
CVE-2026-105793: Command Injection in Microsoft UFO's Mobile MCP Server via Unsanitized ADB Key Codes
A flaw in Microsoft UFO's mobile MCP server lets attackers inject arbitrary ADB shell commands on connected Android devices.
- News
Android 17 Advanced Protection Locks Accessibility Services to Verified Tools
Android 17's Advanced Protection mode now restricts the AccessibilityService API to verified Accessibility Tools, closing a top banking-trojan vector.
- Security
CVE-2026-96587: Viidure Dashcam Android App Hardcodes Cloud Storage Credentials
Maximum-severity CVSS 10.0 flaw: Viidure's dashcam Android app hardcodes plaintext cloud storage keys, exposing firmware and binaries to tampering.
- News
Google Hit With $463 Million Fine for EU Location Data Rule Breach
Ireland's DPC fined Google €403M ($463M) after finding it unlawfully processed Location History, Web & App Activity, and Location Accuracy data.
- News
RatHat Android Trojan Uses AI to Automate Device Takeover
Zimperium found RatHat, an Android trojan that feeds the device's accessibility tree to AI to navigate, steal credentials, and evade detection.
- News
New RatHat Android Malware Uses AI to Automate Device Control
Zimperium found RatHat, an Android RAT whose AI subsystem reads accessibility trees to auto-navigate banking apps and steal credentials.
- News
Hackers Abused Claude to Extract Secrets From 1.8 Million Android Apps
Anthropic disrupted a ShinyHunters affiliate that used Claude to scan 1.8M Android APKs for hardcoded secrets, plus Russia- and China-linked hacking ops.
- News
New Android Malware 'Mantax Otax' Encrypts Files, Steals Data, and Harasses Victims
Mantax Otax combines Android ransomware and spyware, adding screen-streaming, OTP theft, and coercive harassment overlays to force extortion payouts.
- News
WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins
Meta announces WhatsApp support for multiple passkeys per account on iOS and Android, ending password reliance with phishing-resistant biometric auth.
- News
ToxicPanda 2.0 Android Banking Trojan Abuses VPN Permissions to Neutralize Google Play Protect
ToxicPanda 2.0 targets 349 financial apps across 16 countries, using VPN hijacking and ADB abuse to bypass Android security.
- News
Banking Trojans Manic, Grandoreiro, and ToxicPanda 2.0 in the Spotlight
Three active banking trojans — spyware-laden Manic, persistent Grandoreiro, and an expanded ToxicPanda 2.0 — are targeting banks across Latin America,...
- News
Hackers Infect Android Car Head Units with Proxy Botnet Malware
A supply-chain attack trojanizes a legitimate Android car head unit update app to quietly enlist vehicles in a proxy botnet or commit ad fraud.
- News
Google Chrome Cuts 7 Billion Unwanted Android Notifications Per Day
Google's Chrome anti-abuse systems blocked more than 7 billion unwanted notifications on Android per day during Q1 2026, using AI-powered detection to...
- Security
CVE-2025-63823: My Safetipin Android App Exposes Hardcoded Credentials (CVSS 9.8)
A critical hardcoded credentials vulnerability in the My Safetipin Android app v5.2.1 allows remote attackers to bypass authentication and gain...
- News
Inside the Underground Business of BTMOB RAT
Flare researchers analyzed thousands of underground posts to reveal how the BTMOB Android RAT evolved from a single MaaS product into a fragmented...
- News
Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates
Researchers at Hunt.io have traced the Flying Eagle Android remote access trojan framework to over 170 internet-exposed control panel servers, as its...
- News
RedHook Android Malware Now Uses Wireless ADB for Shell Access
A new RedHook variant abuses Android's Wireless Debugging feature to gain shell-level privileges without a USB connection — a novel technique that...
- News
RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service
A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service, letting even low-skill criminals take...
- News
New 'Bad Epoll' Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
A use-after-free bug in the Linux kernel's epoll subsystem — CVE-2026-46242 — lets any local user escalate to root on Linux 6.4+ with ~99% reliability. A...
- News
NetNut Proxy Network Disrupted, 2 Million Infected Devices Cut Off
Google's Threat Intelligence Group and the FBI have dismantled NetNut, a residential proxy network built on 2 million compromised Android smart TVs and...
- News
AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android
Researchers have uncovered a novel malware artifact generated using DeepSeek that weaponizes the Chromium File System Access API to encrypt files entirely...
- News
Google Loses Final Appeal to Overturn €4.1 Billion EU Antitrust Fine
The Court of Justice of the European Union has dismissed Google's final appeal against a €4.1 billion antitrust fine, confirming that the company...
- News
Eight-Year-Old Samsung KNOX Flaw Exposed Millions of Galaxy Devices to Kernel Attacks
A high-severity use-after-free vulnerability lurking in Samsung's KNOX security framework for eight years left Galaxy devices from the S9 through S25...
- News
Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
This week's threat roundup covers the Usbliter8 iPhone boot exploit, NarwhalRAT spread via fake Microsoft alerts, The Gentlemen ransomware's GentleKiller...
- News
In Other News: Apple Patches Beats Eavesdropping Flaw, DOT Closes Delta CrowdStrike Probe, AWS Continuum
This week's security roundup covers Apple's patch for a Beats headphones eavesdropping vulnerability, the DOT closing its investigation into Delta's...
- News
'Popa' Botnet Linked to Publicly-Traded Israeli Firm
Security researchers have traced the sprawling Popa Android botnet — which enslaved millions of consumer TV boxes for ad fraud and data scraping — to a...
- Security
CVE-2026-21029: Samsung Galaxy Editing Service Privilege Escalation
A high-severity vulnerability in Samsung's Galaxy Editing Service allows local attackers to execute privileged operations due to improper export of Android…
- Security
CVE-2026-49185: FieldX MDM ADB Topic Command Injection via Runtime.exec()
A critical CVSS 9.8 command injection vulnerability in the FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), enabling…
- Newsletter
June 3 Digest: AI Ransomware, Netlogon RCE, Miasma Supply Chain
An AI-generated ransomware toolkit automates EDR evasion; Windows Netlogon RCE is actively exploited on domain controllers; the Miasma campaign hits Red Hat…
- News
Android June 2026 Update Patches Exploited Zero-Day and 123 Other Vulnerabilities
Google's June 2026 Android security bulletin addresses 124 vulnerabilities including CVE-2025-48595, an actively exploited zero-day used in limited targeted…
- News
One Line of Code Put Billions of Microsoft Android App Downloads at Risk
A single development-mode setting left in production code bypassed Android protections designed to prevent unauthorized apps from accessing Microsoft account…
- News
Google Fixes One Actively Exploited Android Zero-Day, 124 Flaws in June 2026 Update
Google's June 2026 Android security update patches 124 vulnerabilities including one zero-day flaw that has been actively exploited in targeted attacks…
- News
Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid
Researchers at HUMAN Security uncovered Trapdoor, a sophisticated Android ad fraud and malvertising operation that used 455 malicious apps and 183...
- News
In Other News: Big Tech vs Canada Encryption Bill, Cisco's
Other noteworthy stories this week: Big Tech firms push back against Canada's encryption legislation, Cisco releases a free AI security specification, and...
- News
Fake Call History Apps Stole Payments From Users After 7.3
Cybersecurity researchers discovered 28 fraudulent Android apps on Google Play claiming to offer call history lookups, which instead enrolled users in...
- News
Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New
This week's cybersecurity recap covers the Vercel supply chain breach via a compromised AI tool, push fraud campaigns, attackers abusing QEMU virtual...
- News
Google Blocks 8.3B Policy-Violating Ads in 2025, Launches
Google removed over 8.3 billion policy-violating ads and suspended 24.9 million accounts in 2025, while simultaneously rolling out sweeping Android 17...
- News
EngageLab SDK Flaw Exposed 50M Android Users, Including 30M
A now-patched security vulnerability in the widely used EngageLab Android SDK allowed apps on the same device to bypass the Android security sandbox and...
- News
In Other News: ChatGPT Data Leak, Android Rootkit, Water
This week's security stories you may have missed: a ChatGPT conversation data leak, a new Android rootkit on Google Play, a municipal water facility taken...
- News
''NoVoice'' Android Malware on Google Play Infected 2.3
A new Android malware named NoVoice was discovered hiding in over 50 apps on the Google Play Store, with a combined download count of at least 2.3...
- News
Android 17 Blocks Non-Accessibility Apps from Accessibility
Google is testing a new Android Advanced Protection Mode enforcement in Android 17 Beta 2 that automatically strips non-accessibility apps of their...
- News
Android March 2026 Security Update Patches 129
Google's March 2026 Android security bulletin addresses 129 vulnerabilities, including CVE-2026-21385 — an actively exploited zero-day in a Qualcomm...
- News
PromptSpy: First Android Malware to Weaponize Generative AI
ESET researchers discover PromptSpy, the first known Android malware family that abuses Google's Gemini AI at runtime to dynamically navigate device UIs...
- News
ZeroDayRAT Mobile Spyware Enables Total Surveillance of iOS
A new mobile spyware platform called ZeroDayRAT supports Android 5-16 and iOS up to version 26, providing real-time camera streaming, keylogging, 2FA...
- News
Samsung Ends Software Support for Galaxy S21 Series
Samsung's February 2026 update roadmap removes Galaxy S21 lineup from support, while S22 series moves to quarterly updates.