Wpeeper: New Android malware hides behind hacked WordPress sites
https://blog.xlab.qianxin.com/playing-possum-whats-the-wpeeper-backdoor-up-to/
https://blog.xlab.qianxin.com/playing-possum-whats-the-wpeeper-backdoor-up-to/
奇安信 X 实验室
Playing Possum: What's the Wpeeper Backdoor Up To?
Summary
On April 18, 2024, XLab's threat hunting system detected an ELF file with zero detections on VirusTotal being distributed through two different domains. One of the domains was marked as malicious by three security firms, while the other was recently…
On April 18, 2024, XLab's threat hunting system detected an ELF file with zero detections on VirusTotal being distributed through two different domains. One of the domains was marked as malicious by three security firms, while the other was recently…
👍16
DoS McAfee VPN app via deeplink
McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to cause a denial of service through the use of a malformed deep link (CVE-2024-34406)
https://www.mcafee.com/support/?articleId=000002403&page=shell&shell=article-view
McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to cause a denial of service through the use of a malformed deep link (CVE-2024-34406)
https://www.mcafee.com/support/?articleId=000002403&page=shell&shell=article-view
👍14🔥2🥰2❤1
QR code SQL injection and other vulnerabilities in a popular biometric terminal (CVE-2023-3938, CVE-2023-3939, CVE-2023-3940, CVE-2023-3941, CVE-2023-3942, CVE-2023-3943)
https://securelist.com/biometric-terminal-vulnerabilities/112800/
https://securelist.com/biometric-terminal-vulnerabilities/112800/
👍23🔥4
Five campaigns targeting Android users in Egypt and Palestine, most probably operated by the Arid Viper APT group. Three of the campaigns are active, distributing Android spyware AridSpy via dedicated websites
https://www.welivesecurity.com/en/eset-research/arid-viper-poisons-android-apps-with-aridspy/
https://www.welivesecurity.com/en/eset-research/arid-viper-poisons-android-apps-with-aridspy/
Welivesecurity
Arid Viper poisons Android apps with AridSpy
ESET research has discovered Arid Viper espionage campaigns that deploy multistage Android spyware and target people in Egypt and Palestine.
👍15
Operation Celestial Force employs mobile and desktop malware to target Indian entities (GravityRAT, HeavyLift)
https://blog.talosintelligence.com/cosmic-leopard/
https://blog.talosintelligence.com/cosmic-leopard/
Cisco Talos
Operation Celestial Force employs mobile and desktop malware to target Indian entities
Cisco Talos is disclosing a new malware campaign called “Operation Celestial Force” running since at least 2018. It is still active today, employing the use of GravityRAT, an Android-based malware, along with a Windows-based malware loader we track as “HeavyLift.”
❤16🔥2👍1
Driving forward in Android drivers
Blog: https://googleprojectzero.blogspot.com/2024/06/driving-forward-in-android-drivers.html
Presentation: https://archive.org/details/shmoocon2024/Shmoocon2024-SethJenkins-Driving_Forward_in_Android_Drivers.mp4
Proof of concept exploit code(CVE-2023-32832): https://bugs.chromium.org/p/project-zero/issues/detail?id=2470#c4
Blog: https://googleprojectzero.blogspot.com/2024/06/driving-forward-in-android-drivers.html
Presentation: https://archive.org/details/shmoocon2024/Shmoocon2024-SethJenkins-Driving_Forward_in_Android_Drivers.mp4
Proof of concept exploit code(CVE-2023-32832): https://bugs.chromium.org/p/project-zero/issues/detail?id=2470#c4
projectzero.google
Driving forward in Android drivers
Posted by Seth Jenkins, Google Project ZeroIntroduction Android's open-source ecosystem has ...
👍23
👍15❤2
This media is not supported in your browser
VIEW IN TELEGRAM
Exploiting embedded mitel phones for unauthenticated remote code execution
Achieving a fully unauthenticated RCE exploit as root in a Mitel IP phone. Several 0-days were discovered which chained together gives the privilege of completely owning the phone
https://baldur.dk/blog/embedded-mitel-exploitation.html
Achieving a fully unauthenticated RCE exploit as root in a Mitel IP phone. Several 0-days were discovered which chained together gives the privilege of completely owning the phone
https://baldur.dk/blog/embedded-mitel-exploitation.html
👍19❤2👏2
Exfiltrate WhatsApp chat, or internal data of any Android app, running on Android 12 or 13 by exploiting CVE-2024-0044 vulnerability [video]
https://www.mobile-hacker.com/2024/06/17/exfiltrate-sensitive-user-data-from-apps-on-android-12-and-13-using-cve-2024-0044-vulnerability/
https://www.mobile-hacker.com/2024/06/17/exfiltrate-sensitive-user-data-from-apps-on-android-12-and-13-using-cve-2024-0044-vulnerability/
Mobile Hacker
Exfiltrate sensitive user data from apps on Android 12 and 13 using CVE-2024-0044 vulnerability - Mobile Hacker
With physical access to Android device with enabled ADB debugging running Android 12 or 13 before receiving March 2024 security patch, it is possible to access internal data of any user installed app by misusing CVE-2024-0044 vulnerability. Internal data…
👍38❤2👏2
NetHunter Hacker XVI: Metasploit payload generator in a pocket
https://www.mobile-hacker.com/2024/06/20/nethunter-hacker-xvi-metasploit-payload-generator-in-your-pocket/
https://www.mobile-hacker.com/2024/06/20/nethunter-hacker-xvi-metasploit-payload-generator-in-your-pocket/
Mobile Hacker
NetHunter Hacker XVI: Metasploit payload generator in your pocket
We will explore features of using Metasploit payload generator on NetHunter, and show you how to create and deliver custom payloads to Android smartphone
👍30💯5
Mobile OAuth Attacks - iOS URL Scheme Hijacking Revamped
30 popular apps, vulnerable to attack in which any installed iOS app from the Apple App Store could perform an account takeover of victim users
https://evanconnelly.github.io/post/ios-oauth/
30 popular apps, vulnerable to attack in which any installed iOS app from the Apple App Store could perform an account takeover of victim users
https://evanconnelly.github.io/post/ios-oauth/
Evan Connelly
Mobile OAuth Attacks - iOS URL Scheme Hijacking Revamped
Summary
We (Julien Ahrens @MrTuxracer and myself @Evan_Connelly) identified nearly 30 popular apps, as well as a feature within iOS itself, vulnerable to an attack in which any installed iOS app from the Apple App Store could perform an account takeover of…
We (Julien Ahrens @MrTuxracer and myself @Evan_Connelly) identified nearly 30 popular apps, as well as a feature within iOS itself, vulnerable to an attack in which any installed iOS app from the Apple App Store could perform an account takeover of…
👍16
Android Rafel RAT - from Espionage to Ransomware Operations campaigns - attributed to APT-C-35 / DoNot Team APT group
https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Check Point Blog
Rafel RAT, Android Malware from Espionage to Ransomware Operations - Check Point Blog
When it comes to mobile devices, Android is the most popular and used operating system with over 3.9 billion active users in over 190 countries.
👍20👾3👏1
Monitor file system changes using fsmon
▪️supports Linux, iOS, OS X, Android
▪️identify when are binaries loaded (root)
▪️get dropped payloads (root)
▪️identify when are which files opened at app's runtime (db, txt, log, temp...) (non-root)
https://www.mobile-hacker.com/2024/06/24/monitoring-android-file-system-with-fsmon/
▪️supports Linux, iOS, OS X, Android
▪️identify when are binaries loaded (root)
▪️get dropped payloads (root)
▪️identify when are which files opened at app's runtime (db, txt, log, temp...) (non-root)
https://www.mobile-hacker.com/2024/06/24/monitoring-android-file-system-with-fsmon/
Mobile Hacker
Monitoring Android file system with fsmon - Mobile Hacker
fsmon is a FileSystem Monitor utility created by by Sergi Àlvarez at Nowsecure can run on Linux, Android, iOS, FireFox OS, and OS X. It retrieves file system events from a specific directory and displays them in a colorful format or in JSON. You can filter…
👍20❤2
SpyMax – An Android RAT targets Telegram Users
https://labs.k7computing.com/index.php/spymax-an-android-rat-targets-telegram-users/
https://labs.k7computing.com/index.php/spymax-an-android-rat-targets-telegram-users/
K7 Labs
SpyMax – An Android RAT targets Telegram Users
Threat actors are constantly working on novel ways to target users across the globe. This blog is about SpyMax, an […]
😱19👍1
Android Medusa (TangleBot) banking trojan reborn: A New Compact Variant Discovered
https://www.cleafy.com/cleafy-labs/medusa-reborn-a-new-compact-variant-discovered
https://www.cleafy.com/cleafy-labs/medusa-reborn-a-new-compact-variant-discovered
Cleafy
Medusa Reborn: A New Compact Variant Discovered | Cleafy Labs
Discover the latest insights from the Cleafy Threat Intelligence team on new fraud campaigns involving the Medusa (TangleBot) banking trojan. Learn about Medusa's sophisticated capabilities, recent updates, and shifts in distribution strategies targeting…
👍16❤1
Clone and emulate RFID access card in a second using Proxmark3 in a standalone mode
https://www.mobile-hacker.com/2024/06/26/rfid-hacking-with-proxmark3-cloning-emulating-and-standalone-mode/
https://www.mobile-hacker.com/2024/06/26/rfid-hacking-with-proxmark3-cloning-emulating-and-standalone-mode/
Mobile Hacker
RFID Hacking with Proxmark3: Cloning, Emulating, and Standalone Mode - Mobile Hacker
Access cards – those little plastic rectangles that grant us entry to buildings, parking lots, and secure areas. But what if I told you that these cards can be cloned, and even emulated? Enter the Proxmark3, a powerful tool that opens doors (literally) to…
👍19❤6
Snowblind: A new Android malware abuses security feature to bypass security
Blog: https://promon.co/app-threat-reports/snowblind
Demo: https://youtu.be/zUqZQlQ0ZzQ?si=oZhSdfR1w_SlNjSA
Blog: https://promon.co/app-threat-reports/snowblind
Demo: https://youtu.be/zUqZQlQ0ZzQ?si=oZhSdfR1w_SlNjSA
promon.io
Snowblind Android Malware - Promon
👍21❤4🤓1
BADUnboxing: Automated Android unpacker
It works by locating and decompiling code inside the APK that is relevant to the unpacking process. Once Bad Unboxing detects packing, it automatically generates a new Java application based on the decompiled code
https://github.com/LaurieWired/BadUnboxing
It works by locating and decompiling code inside the APK that is relevant to the unpacking process. Once Bad Unboxing detects packing, it automatically generates a new Java application based on the decompiled code
https://github.com/LaurieWired/BadUnboxing
GitHub
GitHub - LaurieWired/BadUnboxing: Automated Android custom unpacker generator
Automated Android custom unpacker generator. Contribute to LaurieWired/BadUnboxing development by creating an account on GitHub.
🔥21👏5👍3🥱2❤1🤡1
Transparent Tribe (aka APT 36, Operation C-Major) Android Spyware Targeting Gamers, Weapons Enthusiasts
https://www.sentinelone.com/labs/capratube-remix-transparent-tribes-android-spyware-targeting-gamers-weapons-enthusiasts/
https://www.sentinelone.com/labs/capratube-remix-transparent-tribes-android-spyware-targeting-gamers-weapons-enthusiasts/
SentinelOne
CapraTube Remix | Transparent Tribe’s Android Spyware Targeting Gamers, Weapons Enthusiasts
SentinelLABS has identified four new CapraRAT APKs associated with suspected Pakistan state-aligned actor Transparent Tribe.
👍18
BlueToolkit - automated Bluetooth vulnerability testing framework
✅Can test 43 exploits
✅Runs on rooted Android, which makes it a portable Bluetooth vulnerability scanner
✅It already helped to find 64 new vulnerabilities in 22 products
https://www.mobile-hacker.com/2024/07/02/uncover-bluetooth-vulnerabilities-with-bluetoolkit/
✅Can test 43 exploits
✅Runs on rooted Android, which makes it a portable Bluetooth vulnerability scanner
✅It already helped to find 64 new vulnerabilities in 22 products
https://www.mobile-hacker.com/2024/07/02/uncover-bluetooth-vulnerabilities-with-bluetoolkit/
Mobile Hacker
Uncover Bluetooth Vulnerabilities with BlueToolkit - Mobile Hacker
BlueToolkit is an extensible Bluetooth Classic vulnerability automated testing framework. It’s designed to uncover both new and old vulnerabilities in Bluetooth-enabled devices. Moreover, since it runs on Linux based devices, it is possible to install it…
👍32👏4