android
Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
A new malware family targeting Android-based car head units has been discovered, exploiting built-in firmware updaters for distribution. This malware, attributed to the MoYu Group, aims to facilitate ad fraud and establish a proxy botnet. Researchers noted this is the first documented case of malware specifically designed for car head units with a tailored infection chain.
Android Malware Steals Payment Card Data via NFC
Researchers have identified a new Android malware called WindRelay that can intercept payment card information transmitted via NFC while the card is still in the user's possession. This malware operates in conjunction with the SpyNote trojan, granting attackers remote control over infected devices. The attack typically begins with a social engineering tactic where a fraudster impersonates a bank representative.
Gemini AI Flaw Lets Strangers Message From Locked Android Phones
A vulnerability has been discovered in Google's Gemini AI assistant for Android devices. This flaw allows unauthorized individuals to send messages from a user's locked phone. The issue potentially exposes users to misuse of their communication channels.
RedWing Android Spyware Sold as a Service on Telegram
A new Android spyware called RedWing is being offered as a service on Telegram, allowing less sophisticated attackers to compromise phones and steal banking information. Researchers have identified it as a polished malware-as-a-service operation with extensive documentation and a subscription model, potentially linked to Russian threat actors. RedWing employs fake login overlays, SMS interception, call forwarding, and even screen control to harvest credentials and conduct further malicious activities.
RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service
A new Malware-as-a-Service offering called RedWing packages Android bank fraud tools and is rented via Telegram. It provides ready-made malware capable of taking over phones and stealing banking credentials and one-time passcodes.
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique
Researchers have demonstrated a novel ransomware technique that operates entirely within a web browser, bypassing the need for native installations or exploits. By leveraging the File System Access API in Chrome, specifically on Android, malicious websites can trick users into granting access to sensitive photo directories. This method, inspired by AI-generated concepts, uses social engineering tactics like fake image-enhancement tools to prompt users for permissions, enabling the browser-based ransomware to potentially encrypt or modify files.
Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool
A threat group linked to Iran, known as TAG-182, is actively distributing a surveillance tool called MarkiRAT. This malware is being spread through fake applications disguised as VPNs and download tools, primarily targeting Iranian citizens both within and outside the country. The operations appear to be conducted via social media platforms and are likely part of Iran's intensified cyber surveillance efforts.
Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android
Google is preparing Android for the advent of quantum computing by integrating post-quantum cryptography (PQC) standards into its operating system. This proactive, multi-year migration aims to protect sensitive data and transactions from being compromised by future quantum computers. The PQC enhancements will be tested starting with the Android 17 beta release and will be available in the production version, establishing a quantum-resistant chain of trust across the platform.