“Android”

Google and partners disrupted XCPE botnet embedded in Videostrong devices, cutting criminal proxy and ad-fraud infrastructure.

PoC for CVE-2026-58882 'SMS of Death' shows attackers can crash or disrupt service on unpatched Android devices via crafted SMS.

MR ROBOT Android banking malware-as-a-service steals OTPs and card data from Indian bank customers via mobile trojans.

A Popcorn Time updater ran at boot and executed code served from its update domain with full privileges.

Midnight Mimosa firmware malware found on thousands of low-cost Android phones, giving attackers persistent system access.

Certificate validation flaws in Zoom clients could allow attackers to access sensitive notes and data without authentication via network control.

Preinstalled firmware malware on MediaTek phones enables covert app installation, ad fraud, and conversion into residential proxies (Midnight Mimosa).

Anthropic research shows cheap IoT devices can run AI models that may self-replicate, creating decentralized AI botnets.

Midnight Mimosa malware found preinstalled on low-cost Android devices across 150+ countries, enabling persistent control and spying.

OX Security found critical MCP protocol vulnerabilities in thousands of public servers exposing AI agent infrastructure risk.

RemControl banking trojan abuses Android Accessibility Service to take remote control and harvest banking credentials.

RemControl Android trojan uses AI-built overlays to steal banking PINs via fake download pages and Play Store lookalikes.

Corp MDM Android spyware targets logistics firms, steals SMS, and redirects calls via fake Google Play pages.

GoldFactory group abuses Android Work Profile to deliver Gigabud Trojan, while Mantax Otax spreads via app-cloning campaigns.

Researchers demonstrate a WeChat zero-click worm capable of hijacking phones via crafted calls using AI tooling.

Researchers built a WeChat zero-click worm that takes over accounts via incoming calls without user interaction, spreading across phones.

NSO Group Pegasus used an iMessage zero-click exploit to infect a Serbian student activist's iPhone enabling remote surveillance.