Author: HyeongJun Kim | S2W TALON

Discover detailed analysis of Salvador Stealer, a new Android malware targeting users of mobile banking apps.

The NCSC and partners publish new information and mitigation measures for those at high risk from two spyware variants.

This advisory provides new and collated threat intelligence on two variants of spyware known as BADBAZAAR and MOONSHINE, and includes advice for app store operators, developers and social media companies to help keep their users safe.

CTM360’s Play Masquerading Party (PMP) report reveals the evolution of the PlayPraetor scam, highlighting fake Play Store pages, phishing apps, and RATs.

SMS Pumping fraud is a deceptive scheme where fraudsters manipulate SMS verification systems to inflate non-organic traffic and generate revenue at businesses’ expense. Discover how it works and ways to mitigate it.

In this article, I will share a tip for those interested in performing a more detailed analysis of the behavior of native methods, with a…

Deceptive websites hosted on newly registered domains are being used to deliver AndroidOS SpyNote malware. These sites mimic the Google Chrome install page on the Google Play Store.

This article marks the first in a series aimed at sharing my adventures, personal notes, and insights into the Android kernel. My focus…

Full title: Rethinking Emulation for Fu(zzi)n(g) and Profit: Near-Native Rehosting for Embedded ARM Firmware
Slides: https://github.com/binarly-io/Research_Publications/blob/main/REverse_2025/Near-Native%20Rehosting%20for%20Embedded%20ARM%20Firmware.pdf
…

TL;DR #1: Rooting an Android device allows for system modifications, bypassing restrictions, and performing security testing. This post…

Flutter Mobile Application Reverse Engineering Tool - worawit/blutter

SpyMax Variant Targeting Chinese-Speaking Users: In early 2025, our threat intelligence team analyzed a highly sophisticated Android spyware.

How I tracked myself down using leaked location data in the in-app ads, and what I found along the way.