⚡ Google adding a 24-hour delay for installing #Android apps from unverified developers.

Users must enable developer mode, reboot, and confirm again after a day. This is meant to stop #malware and scams that trick users into disabling Play Protect or giving access.

🔗 Details here → https://thehackernews.com/2026/03/google-adds-24-hour-wait-for-unverified.html

🛑 ALERT - A flaw in EngageLab’s #Android SDK exposed 30M+ crypto wallet installs to potential data access.

The intent redirection bug allowed sandbox bypass via a malicious app on the same device. No active exploitation found.

🔗Read → https://thehackernews.com/2026/04/engagelab-sdk-flaw-exposed-50m-android.html

🚨 A Mirai-based botnet dubbed xlabs_v1 is exploiting exposed #Android Debug Bridge (ADB) services on port 5555 to hijack IoT devices.

It enables 21 DDoS attack methods and uses bandwidth profiling to tier attacks, targeting game servers.

Read: https://thehackernews.com/2026/05/mirai-based-xlabsv1-botnet-exploits-adb.html

🚨 28 fraudulent apps on the Google Play Store racked up over 7.3 million downloads before removal.

They promised call, SMS, and #WhatsApp histories for any phone number — but delivered only fake data after users paid up to $80.

The CallPhantom scam mainly hit #Android users in India and Asia-Pacific.

Full read → https://thehackernews.com/2026/05/fake-call-history-apps-stole-payments.html

📱 Apple has released iOS 26.5, bringing default end-to-end encryption to RCS messaging between #iPhone and #Android.

Lock icons will indicate encrypted chats, marking a major expansion of secure cross-platform messaging beyond traditional SMS.

Read → https://thehackernews.com/2026/05/ios-265-brings-default-end-to-end.html

🚨 New TrickMo #Android banking trojan variant uses TON for stealthy command-and-control, adding SSH tunnelling and SOCKS5 proxying to turn infected devices into network pivots and traffic-exit nodes.

The malware targeted banking and crypto wallet users in France, Italy, and Austria between January and February 2026.

Read → https://thehackernews.com/2026/05/new-trickmo-variant-uses-ton-c2-and.html

⚡ Google is rolling out #Android Intrusion Logging, an opt-in feature that stores encrypted forensic logs for 12 months to help investigate suspected spyware attacks.

Available on Android 16 December update and newer.

Full story: https://thehackernews.com/2026/05/android-adds-intrusion-logging-for.html

🚨 Trapdoor used 455 malicious #Android apps to run a malvertising and ad fraud scheme that peaked at 659 Million bid requests per day.

The apps were downloaded over 24M times, with most traffic from the U.S.

Read: https://thehackernews.com/2026/05/trapdoor-android-ad-fraud-scheme-hit.html

⚠️ Two new #Android NFC relay malware families — DevilNFC and NFCMultiPay — are targeting banking customers in Europe and Latin America.

These tools, developed with possible AI assistance, steal card PINs. DevilNFC even locks victims in a fake interface using Kiosk Mode while relaying card data.

Local threat actors are now building their own tools instead of relying on Chinese MaaS platforms.

Read this story: https://thehackernews.com/2026/05/weekly-recap-linux-flaws-defender-0.html#:~:text=DevilNFC%20and%20NFCMultiPay%20Android%20NFC%20Relay%20Malware

🚨 Android just patched 124 security flaws.

One of them — CVE-2025-48595 (CVSS 8.4) — may already be seeing limited targeted exploitation.

No user interaction required. #Android 14, 15, 16, and 16 QPR2 affected.

Read: https://thehackernews.com/2026/06/google-june-2026-android-update-patches.html

🚨 New #Android spyware Asin is targeting journalists and researchers in Arabic-speaking regions.

It spreads through fake websites impersonating government news, PDF editors, and war maps.

The apps hide #spyware behind useful features and were found on Android 15 devices.

Read: https://thehackernews.com/2026/06/android-spyware-asin-targets-arabic.html

This week’s cyber recap is stacked:

🌐 Chrome 0-day exploited
🏛️ Oracle PeopleSoft hit
🐧 Arch AUR packages poisoned
🔐 Check Point VPN attacks
📡 UniFi flaws exploited
🎣 Major phishing kit takedown
🤖 AI brands used as bait
🍎 #macOS fake installers
📦 npm/PyPI malware
📱 #Android adware
☁️ Cloud logging abuse risks
🕵️ RAT using Google Sheets
💾 Ransomware data exfil tricks

Plus urgent CVEs, tools, and expert webinars.

Read here: https://thehackernews.com/2026/06/weekly-recap-chrome-0-day-unifi.html

⚡ Another Monday, another cyber mess.

Browser bugs. EDR killers. TV botnet. #Android trojans. Splunk exploit. SocGholish cleanup. Fake crypto tools. Poisoned widgets. ClickFix lures. OpenBSD’s 27-year flaw. Entra bypass. SQL Server C2.

Read the weekly recap 🠖 https://thehackernews.com/2026/06/weekly-recap-browser-bugs-edr-killers.html

🛑 Android sideloading is getting a major new checkpoint.

Starting Sept. 30, 2026, certified #Android phones in Brazil, Indonesia, Singapore, and Thailand will block normal installs from unverified developers.

That applies beyond #Google Play, including third-party app stores and direct APK installs.

Details - https://thehackernews.com/2026/06/google-sets-sept-30-deadline-for.html

⚡ New "Bad Epoll" (CVE-2026-46242) vulnerability affects #Linux 6.4+ kernels and may reach newer #Android devices.

It can turn a local user into root; the PoC hit 99% reliability and may trigger from Chrome’s renderer sandbox.

🔗 Read how the bug works: https://thehackernews.com/2026/07/new-bad-epoll-linux-kernel-flaw-lets.html

🛑 WARNING - #Android bank fraud is being packaged for rent on Telegram.

Researchers are warning of RedWing, a mobile MaaS operation that gives buyers custom APKs, fake app-store lures, login overlays, OTP theft, and call forwarding.

82 institutions are listed as targets.

Learn more - https://thehackernews.com/2026/07/redwing-maas-packages-android-bank.html

🛑 ALERT - A VPN is supposed to hide your traffic. A new study says many free #Android VPN apps do not.

Researchers tested 281 popular apps with 2.4B+ installs:

→ 29 leak traffic, including visited sites
→ 246 contact ad/tracking servers
→ 5 could let a same-Wi-Fi attacker hijack the tunnel

The app still says “connected.”

Check whether yours is listed: https://thehackernews.com/2026/07/study-of-281-free-android-vpn-apps.html

🔥 European Union (EU) has ordered Google to open #Android features to rival AI assistants, including the camera, microphone, screen contents, locked-screen hotwords, and background app control.

Consent still applies. For six features, Google cannot require certification.

Here's what changes, and when - https://thehackernews.com/2026/07/eu-orders-google-to-open-android-mic.html

⚠️ Russian state-backed hackers are using fake CAPTCHA checks to trick Ukrainian targets into running malware on their own Windows systems.

The same campaign also uses fake security apps to backdoor #Android devices.

Read the full attack chain: https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html

🚨 Invisible text on an #Android screen can hijack an AI agent and make it run commands on the PC controlling the phone.

Researchers tested 5 open-source frameworks. Every one failed at least six of seven attacks.

Read how the chain works: https://thehackernews.com/2026/07/open-source-android-ai-agents-could-let.html