Android Security & Malware

Google Project Zero breaks down a 0-click Android exploit that hijacked Samsung phones via a malicious DNG image—originally flagged by Unit 42.
Patched in April 2025 (CVE-2025-21042)
https://googleprojectzero.blogspot.com/2025/12/a-look-at-android-itw-dng-exploit.html

projectzero.google

A look at an Android ITW DNG exploit

IntroductionBetween July 2024 and February 2025, 6 suspicious image files were uploaded to VirusT...

❤24👍4

10.3K views09:20

👍 29 👎 1

Android Security & Malware

Security flaws in Freedom Chat app exposed users' phone numbers and PINs
https://ericdaigle.ca/posts/super-secure-maga-messaging-app-leaks-everyones-phone-number/

⚡10👍4❤2

7.39K views10:24

👍 17 👎

Android Security & Malware

ipsw: command-line framework for Apple firmware analysis and interact with iOS devices
https://github.com/blacktop/ipsw

GitHub

GitHub - blacktop/ipsw: iOS/macOS Research Swiss Army Knife

iOS/macOS Research Swiss Army Knife. Contribute to blacktop/ipsw development by creating an account on GitHub.

🎃9👍5👾1

7.77K views15:34

👍 20 👎 1

Android Security & Malware

Frogblight: New Android banker targets Turkish users
https://securelist.com/frogblight-banker/118440/

👍7❤4🌚4

7.23K views13:40

👍 12 👎 1

Android Security & Malware

Cellik - A New Android RAT With Play Store Integration
https://iverify.io/blog/meet-cellik---a-new-android-rat-with-play-store-integration

iverify.io

Meet Cellik - A New Android RAT With Play Store Integration

Discover how Cellik Android RAT enables full device surveillance with live screen access, keylogging, app injection, and Play Store APK wrapping.

👍14🌚5❤4

9.22K views14:03

👍 28 👎 6

Android Security & Malware

Kimwolf Botnet Hacked 1.8 Million Android TVs, Launched DDoS Attacks, Proxy
https://blog.xlab.qianxin.com/kimwolf-botnet-en/

奇安信 X 实验室

Kimwolf Exposed: The Massive Android Botnet with 1.8 Million Infected Devices

Background

On October 24, 2025, a trusted partner in the security community provided us with a brand-new botnet sample. The most distinctive feature of this sample was its C2 domain, 14emeliaterracewestroxburyma02132[.]su, which at the time ranked 2nd in…

🌚11👍7🎄3

8.07K views07:30

👍 18 👎

Android Security & Malware

Kimsuky Distributing Malicious Mobile App via QR Code
https://www.enki.co.kr/en/media-center/blog/kimsuky-distributing-malicious-mobile-app-via-qr-code

www.enki.co.kr

Kimsuky Distributing Malicious Mobile App via QR Code | Enki White Hat

👍11🔥6❤3🌚2

8.51K views09:47

👍 14 👎 2

Android Security & Malware

Analysis of CVE-2025-31200, a zero-day, zero-click RCE in iOS. Triggered by a malicious audio file via iMessage/SMS. Exploitation bypassed Blastdoor, enabled kernel escalation (CVE-2025-31201), and allowed token theft until patched in iOS 18.4.1 (Apr 16, 2025)
https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201

GitHub

GitHub - JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201: CVE-2025-31200 is a zero-day, zero-click RCE in iOS CoreAudio’s…

CVE-2025-31200 is a zero-day, zero-click RCE in iOS CoreAudio’s AudioConverterService, triggered by a malicious audio file via iMessage/SMS. Exploitation bypassed Blastdoor, enabled kernel escalati...

🔥16👍6❤2🌚2

10.2K views08:25

👍 25 👎 4

Android Security & Malware

CVE-2025-38352 - In-the-wild Android Kernel Vulnerability Analysis + PoC
https://faith2dxy.xyz/2025-12-22/cve_2025_38352_analysis/
PoC: https://github.com/farazsth98/poc-CVE-2025-38352

faith2dxy.xyz

CVE-2025-38352 (Part 1) - In-the-wild Android Kernel Vulnerability Analysis + PoC

Analyzing and writing a PoC for CVE-2025-38352.

⚡10👍5👾3🔥2

9.33K viewsedited 07:54

👍 27 👎

Android Security & Malware

A New Stage in the Evolution of Android SMS Stealers in Uzbekistan
https://www.group-ib.com/blog/mobile-malware-uzbekistan/

Group-IB

Choose Your Fighter: A New Stage in the Evolution of Android SMS Stealers in Uzbekistan

Group-IB analyzes the evolution of Android malware in Uzbekistan, revealing advanced droppers, encrypted payload delivery, anti-analysis techniques, and Wonderland’s bidirectional SMS-stealing capabilities driving large-scale financial fraud.

❤9👍6🔥4

10.6K views13:39

👍 21 👎 1

Android Security & Malware

DNGerousLINK: A Deep Dive into WhatsApp 0-Click Exploits on iOS and Samsung Devices (CVE-2025-55177, CVE-2025-43300)
https://media.ccc.de/v/39c3-dngerouslink-a-deep-dive-into-whatsapp-0-click-exploits-on-ios-and-samsung-devices

media.ccc.de

DNGerousLINK

The spyware attack targeting WhatsApp, disclosed in August as an in-the-wild exploit, garnered significant attention. By simply knowing a...

👍16🔥7❤4🌚2

9.79K views11:20

👍 27 👎 1

Android Security & Malware

Android revers engineering and malware analysis notes
https://www.notion.so/Reverse-Engineering-8f11869a35fa4832a01896f1b503261f
https://www.notion.so/Malware-Analysis-e1006868cce24a769e0ca4349b87ef31

Secure's Notion on Notion

Reverse Engineering | Notion

@Android Internals Review

❤22🔥11👍6

10.5K views19:03

👍 35 👎 4

Android Security & Malware

Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable Linux kernels v5.10.x.
https://github.com/farazsth98/chronomaly

GitHub

GitHub - farazsth98/chronomaly: Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable…

Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable x86_64 Linux kernels v5.10.x. - farazsth98/chronomaly

👍14❤5🎃5👏1

10.5K views10:38

👍 35 👎

Android Security & Malware

Read, write, and emulate NFC cards on jailbroken iPhones
https://github.com/OwnGoalStudio/TrollNFC/

GitHub

GitHub - OwnGoalStudio/TrollNFC: A versatile tool for reading, writing, managing, and emulating NFC cards on your iPhone.

A versatile tool for reading, writing, managing, and emulating NFC cards on your iPhone. - OwnGoalStudio/TrollNFC

👍16😈2🤡1