How the Gigabud Android banking trojan abuses Shelter, an open-source app cloner, and what that means for banks, users, and defenders.

true

true

Do you have an older rooted Android phone sitting unused in a drawer? Instead of leaving it there, you can turn it into a practical NFC reader and USB keyboard for your computer. With a custom Android app (NFC to HID), your phone can read the unique indentation…

Chaining an AtlasService binder command injection and an olc2 HAL binder method into uid 0 with all Linux capabilities from a plain installable app on OxygenOS 16.

Group-IB uncovers RemControl, a new Android banking trojan targeting European, Middle Eastern and Canadian banks, whose criminal infrastructure was unknowingly built by AI.

A native APK and DEX decompiler written in Rust. Contribute to Ch0pin/rdx development by creating an account on GitHub.

Cleafy's TIR team analyzed the operator infrastructure behind RATHat, an Android banking trojan that abuses Accessibility Services to enable wireless debugging on the victim's phone, obtain a shell, and deploy a hidden native service outside the app. The…

A look at the targeted AI taskflows behind these findings, the bugs they uncovered, and how to run the same open-source agent on your own app.

CVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF — iOS/macOS kernel vulnerability leading to deferred panic (A19 Pro, iOS 26.3 RC) - 0xjohnnydev/CVE-2026-20687-AppleJPEGDriver-UAF

An in-the-wild iOS bug with a possible WhatsApp zero-click path.

Watch me trying to find a Whatsapp nDay, thanks to Meta and inline compiling it's not that easy !

Bitdefender has identified a malware campaign (dubbed Midnight Mimosa) running on low-cost, multi-brand Android devices built on MediaTek platforms.

A complete technical write-up of an engagement against an active Android banking-fraud operation — recon, malware internals, platform…

Hirudo replaces Indonesian banking apps with patched copies that blind their defences. We break down its patching, distribution, targeting and fraud.

By Hyunseo Shin · October 2026 · Korean version

A use-after-free in Android's Binder driver, recorded once and replayed at will. Part 1 of a full kernel exploit chain built with time travel debugging.

Doctor Web has identified a dangerous backdoor, <a href="https://vms.drweb.com/search/?q=Android.Backdoor.Baohuo.1.origin&lng=en"><b>Android.Backdoor.Baohuo.1.origin</b></a>, in maliciously modified versions of the Telegram X messenger. In addition to being…

How one exported activity in Microsoft Authenticator let an unprivileged app get tokens for any Microsoft service.