Android Security & Malware

Rethinking Emulation for Fu(zzi)n(g) and Profit: Near-Native Rehosting for Embedded ARM Firmware
[Presentation] https://www.youtube.com/watch?v=o_ckTnTQlfs
[Slides] https://github.com/binarly-io/Research_Publications/blob/main/REverse_2025/Near-Native%20Rehosting%20for%20Embedded%20ARM%20Firmware.pdf

YouTube

RE//verse 2025: Rethinking Emulation for Fu(zzi)n(g) (Lukas Seidel)

Full title: Rethinking Emulation for Fu(zzi)n(g) and Profit: Near-Native Rehosting for Embedded ARM Firmware
Slides: https://github.com/binarly-io/Research_Publications/blob/main/REverse_2025/Near-Native%20Rehosting%20for%20Embedded%20ARM%20Firmware.pdf
…

🌚8❤1

8.7K views08:09

👍 13 👎

Android Security & Malware

Shibai: Trojanized version of WhatsApp that comes preinstalled on some low-cost Android phones. Altered using LSPatch, it replaces cryptocurrency addresses in messages and redirects update URLs to retain control
https://news.drweb.com/show/?lng=en&i=15002&c=5

🌚11👍1

9.27K views12:33

👍 15 👎 2

Android Security & Malware

Magisk for Mobile Pentesting: Rooting Android Devices and Building Custom Modules
Part 1: https://medium.com/@justmobilesec/magisk-for-mobile-pentesting-rooting-android-devices-and-building-custom-modules-part-i-3ca7429f1faf
Part 2: https://medium.com/@justmobilesec/magisk-for-mobile-pentesting-rooting-android-devices-and-building-custom-modules-part-ii-22badc498437

Medium

Magisk for Mobile Pentesting: Rooting Android Devices and Building Custom Modules (Part I)

TL;DR #1: Rooting an Android device allows for system modifications, bypassing restrictions, and performing security testing. This post…

🔥20👍5❤3👏1😱1

12.1K views20:21

👍 37 👎 1

Android Security & Malware

Intercepting HTTPS Communication in Flutter: Going Full Hardcore Mode with Frida
https://sensepost.com/blog/2025/intercepting-https-communication-in-flutter-going-full-hardcore-mode-with-frida/

🔥15👍6🌚1

14.2K views18:50

👍 32 👎 4

Android Security & Malware

B(l)utter: Flutter Mobile Application Reverse Engineering Tool
https://github.com/worawit/blutter

GitHub

GitHub - worawit/blutter: Flutter Mobile Application Reverse Engineering Tool

Flutter Mobile Application Reverse Engineering Tool - worawit/blutter

👍17❤4🔥3🌚1

8.28K views11:14

👍 32 👎 2

Android Security & Malware

SpyMax Variant Targeting Chinese-Speaking Users
https://threatmon.io/spymax-variant-targeting-chinese-speaking-users/

ThreatMon

SpyMax Variant Targeting Chinese-Speaking Users

SpyMax Variant Targeting Chinese-Speaking Users: In early 2025, our threat intelligence team analyzed a highly sophisticated Android spyware.

👍11🌚2

7.21K views07:11

👍 11 👎 2

Android Security & Malware

Android spyware trojan targets Russian military personnel who use Alpine Quest mapping software
https://news.drweb.com/show/?i=15006&lng=en&c=5

👍9

6.99K views08:51

👍 13 👎 2

Android Security & Malware

Everyone knows your location: tracking myself down through in-app ads
Part 1: https://timsh.org/tracking-myself-down-through-in-app-ads/
Part 2: https://timsh.org/everyone-knows-your-location-part-2-try-it-yourself/
Plus a guide that helps to collect, analyze and visualize requests sent by a mobile device while using some app: https://github.com/tim-sha256/analyse-ad-traffic

tim.sh

Everyone knows your location

How I tracked myself down using leaked location data in the in-app ads, and what I found along the way.

🔥17❤1👍1

7.74K views09:58

👍 20 👎 2

Android Security & Malware

SuperCard X: exposing a Chinese-speaker MaaS for NFC Relay fraud operation
https://www.cleafy.com/cleafy-labs/supercardx-exposing-chinese-speaker-maas-for-nfc-relay-fraud-operation?s=03

Cleafy

SuperCard X: exposing a Chinese-speaker MaaS for NFC Relay fraud operation | Cleafy

A new fraud campaign based on the Android malware "SuperCard X" and innovative NFC relay techniques is impacting Italian's banking. Read our latest report to learn more.

💩8🔥4❤2👍1

7.6K views10:23

👍 11 👎 1

Android Security & Malware

CVE-2024-53104 proof of concept: Privilege escalation security flaw in the Android Kernel's USB Video Class driver that allows authenticated local threat actors to elevate privileges in low-complexity attacks
https://github.com/zhuowei/facedancer/blob/rawgadget2/examples/camera.py#L15

GitHub

facedancer/examples/camera.py at rawgadget2 · zhuowei/facedancer

Fork of https://github.com/xairy/Facedancer/tree/rawgadget with patches for testing CVE-2024-53197 - zhuowei/facedancer

🔥19👍4

8.84K views11:31

👍 16 👎 1

Android Security & Malware

Rooting an Android Emulator for Mobile Security Testing
https://8ksec.io/rooting-an-android-emulator-for-mobile-security-testing/

8kSec

Rooting Android Emulator for Security Testing | 8kSec

Step-by-step guide to rooting an Android Virtual Device (AVD) using rootAVD for security testing. Enable root access for Frida, dynamic analysis, and more.

🔥21👍9❤1🥰1🌚1

10.4K views16:48

👍 34 👎

Android Security & Malware

Triada strikes back
https://securelist.com/triada-trojan-modules-analysis/116380/

❤‍🔥13👍4❤3🌚1

10.2K views13:53

👍 21 👎

Android Security & Malware

AirBorne: Wormable Zero-Click Remote Code Execution (RCE) in AirPlay Protocol Puts Apple & IoT Devices at Risk
https://www.oligo.security/blog/airborne

www.oligo.security

Airborne: Wormable Zero-Click RCE in Apple AirPlay Puts Billions of Devices at Risk | Oligo Security

Oligo Security reveals AirBorne, a new set of vulnerabilities in Apple’s AirPlay protocol and SDK. Learn how zero-click RCEs, ACL bypasses, and wormable exploits could endanger Apple and IoT devices worldwide — and how to protect yourself.

🌚8👍2🤷‍♂1👎1🥰1

10.3K views14:32

👍 24 👎 1

Android Security & Malware

EvilNotify: Single line of code could soft-brick iPhones by sending malicious notifications (CVE-2025-24091)
https://rambo.codes/posts/2025-04-24-how-a-single-line-of-code-could-brick-your-iphone

Rambo Codes

How a Single Line Of Code Could Brick Your iPhone | Rambo Codes

Gui Rambo writes about his coding and reverse engineering adventures.

🔥15💩5