Android banking trojan Zanubis, first appeared around August 2022, targeting financial institution and cryptocurrency exchange users in Peru
Zanubis’s main infection path is through impersonating legitimate Peruvian Android applications and then tricking the user into enabling the Accessibility permissions in order to take full control of the device
https://securelist.com/crimeware-report-asmcrypt-loader-lumma-stealer-zanubis-banker/110512/
Zanubis’s main infection path is through impersonating legitimate Peruvian Android applications and then tricking the user into enabling the Accessibility permissions in order to take full control of the device
https://securelist.com/crimeware-report-asmcrypt-loader-lumma-stealer-zanubis-banker/110512/
👍14🥱2
Analysis of LightSpy mAPT Mobile Payment System Attack attributed to APT-41 group
https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack
https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack
ThreatFabric
LightSpy mAPT Mobile Payment System Attack
ThreatFabric tied DragonEgg Android spyware to sophisticated iOS targeted malware LightSpy and revealed previously unknown unique additional payloads.
👍12🤔2❤1
BADBOX: a firmware backdoored trojan found in 74,000 Chinese Android phones, tablets, and TV boxes in 227 counties and territories
There are confirmed 8 devices with backdoors installed — seven TV boxes, the T95, T95Z, T95MAX, X88, Q9, X12PLUS, and MXQ Pro 5G, and a tablet J5-W.
BADBOX functionality:
-Ad Fraud,
-Uses backdoored devices as proxy,
-Create fake accounts,
-Downloads and runs additional modules.
Report: https://www.humansecurity.com/hubfs/HUMAN_Report_BADBOX-and-PEACHPIT.pdf
There are confirmed 8 devices with backdoors installed — seven TV boxes, the T95, T95Z, T95MAX, X88, Q9, X12PLUS, and MXQ Pro 5G, and a tablet J5-W.
BADBOX functionality:
-Ad Fraud,
-Uses backdoored devices as proxy,
-Create fake accounts,
-Downloads and runs additional modules.
Report: https://www.humansecurity.com/hubfs/HUMAN_Report_BADBOX-and-PEACHPIT.pdf
😱9👍4🔥2😡2❤1⚡1🤣1
NetHunter Hacker IX: How to use MANA Toolkit to create Wi-Fi rogue access point and intercept HTTP traffic
https://www.mobile-hacker.com/2023/10/05/nethunter-hacker-ix-use-mana-toolkit-to-create-wi-fi-rogue-access-point-and-intercept-traffic/
https://www.mobile-hacker.com/2023/10/05/nethunter-hacker-ix-use-mana-toolkit-to-create-wi-fi-rogue-access-point-and-intercept-traffic/
Mobile Hacker
NetHunter Hacker IX: Use MANA Toolkit to create Wi-Fi rogue access point and intercept traffic - Mobile Hacker
MANA allows you to perform various Wi-Fi attacks even using your Android device. The MANA (MITM And Network Attacks) Wireless Toolkit is a suite of tools that can be used to perform man-in-the-middle (MITM) attacks, create evil access point, denial of service…
👍24🤔3
Trigger iOS proximity paring messages from over 50 meters using Android phone
The update of the blog explains how to boost transmitted signal from Android nRF Connect app, demonstrates running AppleJuice on iOS17 and using cheap Arduino ESP32 board
https://www.mobile-hacker.com/2023/09/07/spoof-ios-devices-with-bluetooth-pairing-messages-using-android/
The update of the blog explains how to boost transmitted signal from Android nRF Connect app, demonstrates running AppleJuice on iOS17 and using cheap Arduino ESP32 board
https://www.mobile-hacker.com/2023/09/07/spoof-ios-devices-with-bluetooth-pairing-messages-using-android/
Mobile Hacker
Spoof iOS devices with Bluetooth pairing messages using Android - Mobile Hacker
[update 09.10.2023] In this update, I will share how to extend the signal of Android nRF Connect app that can send pairing messages, demonstrate AppleJuice on the latest iOS 17, show which specific advertisement packet can trigger pop-ups from up to 50 meters…
👍11
Get external IP address of the user during Telegram call. Now it works well and returns public instead of local IP
https://twitter.com/androidmalware2/status/1711313647576686621
https://twitter.com/androidmalware2/status/1711313647576686621
X (formerly Twitter)
Mobile Hacker (@androidmalware2) on X
Get external IP address of the user during #Telegram call. Now it works well and returns public instead of local IP
https://t.co/hfiK1Lz6Mh
https://t.co/hfiK1Lz6Mh
❤18👎3👍1
Well explained blog on how to find and exploit XSS in Android apps in WebViews and Deep Links
https://securityboulevard.com/2023/10/execution-of-arbitrary-javascript-in-android-application/
https://securityboulevard.com/2023/10/execution-of-arbitrary-javascript-in-android-application/
Security Boulevard
Execution of Arbitrary JavaScript in Android Application
In this blog, we will learn about the possible ways to find cross-site scripting by abusing JavaScript in Android applications. Cross-site scripting (XSS) in an Android application occurs when an attacker successfully injects malicious scripts (usually JavaScript)…
👍18❤1
Unmasking the Godfather - Reverse Engineering the Latest Android Banking Trojan
Talk: https://youtu.be/jNQmc2REwFg
Slides: https://github.com/LaurieWired/StrangeLoop
Talk: https://youtu.be/jNQmc2REwFg
Slides: https://github.com/LaurieWired/StrangeLoop
YouTube
"Unmasking the Godfather - Reverse Engineering the Latest Android Banking Trojan" by Laurie Kirk
Banking malware has wreaked havoc on millions of Android users over the last few years, employing advanced stealth techniques to evade detection. During this presentation, I will reverse engineer the Java code of the pervasive Godfather Android banking malware…
👍20❤4
iOS Pentesting Series
Learn how to work with useful tools and apps such as Frida, Objection, 3uTools, Cydia, Burp, fsmon, fridump, SSL bypass, reFlutter etc.
Part 1: https://kishorbalan.medium.com/start-your-first-ios-application-pentest-with-me-part-1-1692311f1902
Part 2: https://kishorbalan.medium.com/ios-pentesting-series-part-2-into-the-battlefield-f17ed2778890
Part 3: https://kishorbalan.medium.com/ios-pentesting-series-part-3-the-ceasefire-53fcea3bbd70
Learn how to work with useful tools and apps such as Frida, Objection, 3uTools, Cydia, Burp, fsmon, fridump, SSL bypass, reFlutter etc.
Part 1: https://kishorbalan.medium.com/start-your-first-ios-application-pentest-with-me-part-1-1692311f1902
Part 2: https://kishorbalan.medium.com/ios-pentesting-series-part-2-into-the-battlefield-f17ed2778890
Part 3: https://kishorbalan.medium.com/ios-pentesting-series-part-3-the-ceasefire-53fcea3bbd70
Medium
Start your first iOS Application Pentest with me.. (Part- 1)
Hola Heckers,
🔥12👍7
How to detect Wi-Fi deauthentication attack and even receive notification on your smartphone
https://www.mobile-hacker.com/2023/10/12/detect-wi-fi-deauthentication-attack-using-esp8266-and-receive-notification-on-smartphone/
https://www.mobile-hacker.com/2023/10/12/detect-wi-fi-deauthentication-attack-using-esp8266-and-receive-notification-on-smartphone/
Mobile Hacker
Detect Wi-Fi deauthentication attack using ESP8266 and receive notification on smartphone Mobile Hacker
A Wi-Fi deauthentication attack, also known as a "deauth attack" or "disassociation attack," is a type of denial-of-service that targets wireless networks. The primary goal of this attack is to disconnect or deauthenticate devices (such as smartphones, laptops…
👍26🤣3❤2
An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit
https://googleprojectzero.blogspot.com/2023/10/an-analysis-of-an-in-the-wild-ios-safari-sandbox-escape.html
https://googleprojectzero.blogspot.com/2023/10/an-analysis-of-an-in-the-wild-ios-safari-sandbox-escape.html
projectzero.google
An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit
By Ian Beer A graph representation of the sandbox escape NSExpression payload In April this yea...
👍6❤1
PoC exploit for CVE-2023-41993 where web content may lead to arbitrary code execution affecting iOS before 16.7
https://github.com/po6ix/POC-for-CVE-2023-41993
https://github.com/po6ix/POC-for-CVE-2023-41993
GitHub
GitHub - po6ix/POC-for-CVE-2023-41993
Contribute to po6ix/POC-for-CVE-2023-41993 development by creating an account on GitHub.
👍12🔥1
Analysis of SpyNote spyware that logs and steals a variety of information, including key strokes, call logs, information on installed applications etc.
https://blog.f-secure.com/take-a-note-of-spynote/
https://blog.f-secure.com/take-a-note-of-spynote/
F-Secure
Useful online security tips and articles | F‑Secure
True cyber security combines advanced technology and best practice. Get tips and read articles on how to take your online security even further.
👍10🥱6😴1💅1
Malicious “RedAlert - Rocket Alerts” Application Targets Israeli Phone Calls, SMS, and User Information through fake website
https://blog.cloudflare.com/malicious-redalert-rocket-alerts-application-targets-israeli-phone-calls-sms-and-user-information/
https://blog.cloudflare.com/malicious-redalert-rocket-alerts-application-targets-israeli-phone-calls-sms-and-user-information/
The Cloudflare Blog
Malicious “RedAlert - Rocket Alerts” application targets Israeli phone calls, SMS, and user information
On October 13, 2023, Cloudflare’s Cloudforce One Threat Operations Team became aware of a malicious Google Android application impersonating the real-time rocket alert app, Red Alert, which provides real-time rocket alerts for Israeli citizens
👍16👏1
BLE Spam allows now to send unwanted notifications to iOS, Android and Windows at once using Flipper Zero.
If you don't have Flipper Zero, in the blog I explained how to trigger popups using any Android smartphone even with custom messages
https://www.mobile-hacker.com/2023/10/17/spam-ios-android-and-windows-with-bluetooth-pairing-messages-using-flipper-zero-or-android-smartphone/
If you don't have Flipper Zero, in the blog I explained how to trigger popups using any Android smartphone even with custom messages
https://www.mobile-hacker.com/2023/10/17/spam-ios-android-and-windows-with-bluetooth-pairing-messages-using-flipper-zero-or-android-smartphone/
Mobile Hacker
Spam iOS, Android and Windows with Bluetooth pairing messages using Flipper Zero or Android smartphone - Mobile Hacker
So far, it was possible to spam through proximity paring messages only iOS devices, either using Flipper Zero, Arduino board or any Android as explained in my previous blog here. However, recently developers of Xtreme firmware for Flipper Zero pushed and…
👍13❤3🔥1🤔1
iObfuscate: Unraveling iOS Obfuscation Techniques
Examine multiple examples of Reverse Engineering iOS obfuscation techniques
https://github.com/LaurieWired/ObjectiveByTheSea2023/
Examine multiple examples of Reverse Engineering iOS obfuscation techniques
https://github.com/LaurieWired/ObjectiveByTheSea2023/
GitHub
GitHub - LaurieWired/ObjectiveByTheSea2023: This contains notes and slides for my Objective by the Sea talk
This contains notes and slides for my Objective by the Sea talk - LaurieWired/ObjectiveByTheSea2023
👍18❤3🔥2
Automatically extract URL and IP endpoints from Android app to a text file using apk2url.
Fast and useful tool for pentesters, bug bounty hunters, or malware analyst
https://github.com/n0mi1k/apk2url
Fast and useful tool for pentesters, bug bounty hunters, or malware analyst
https://github.com/n0mi1k/apk2url
GitHub
GitHub - n0mi1k/apk2url: An OSINT tool to quickly extract IP and URL endpoints from APKs by disassembling and decompiling
An OSINT tool to quickly extract IP and URL endpoints from APKs by disassembling and decompiling - n0mi1k/apk2url
🔥20👍8🤔2❤1
Analysis of Rusty Droid Android RAT
https://labs.k7computing.com/index.php/rusty-droid-under-the-hood-of-a-dangerous-android-rat/
https://labs.k7computing.com/index.php/rusty-droid-under-the-hood-of-a-dangerous-android-rat/
K7 Labs
Rusty Droid: Under the Hood of a Dangerous Android RAT
Threat actors focus on gaining remote access and control of victims’ devices. For this they either use fake apps or […]
👍12❤3😁2🤔1
The outstanding stealth of Operation Triangulation
https://securelist.com/triangulation-validators-modules/110847/
https://securelist.com/triangulation-validators-modules/110847/
👍10🥰1
How to increase radio range of Flipper Zero beyond 100 meters | internal vs. external radio module
https://www.mobile-hacker.com/2023/10/24/how-to-increase-radio-range-of-flipper-zero-yourself-beyond-100-meters/
https://www.mobile-hacker.com/2023/10/24/how-to-increase-radio-range-of-flipper-zero-yourself-beyond-100-meters/
Mobile Hacker
How to increase radio range of Flipper Zero yourself beyond 100 meters Mobile Hacker
Equipped with an integrated module, Flipper Zero is capable of both receiving and transmitting radio frequencies spanning from 300 MHz to 928 MHz. This module enables to capture, store, and replicate remote controls, commonly employed for tasks such as interfacing…
👍18❤3🤔1