android news
10 stories
Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools
Android 17 is set to introduce a new security enhancement under its Advanced Protection feature, which will significantly restrict how accessibility services can be utilized. The reported change indicates that only applications specifically designated and verified as legitimate Accessibility Tools will be granted access to these powerful services. This move directly addresses a long-standing…
Malware Hijacks Android Car Head Units
Cybersecurity researchers have uncovered a new Android malware variant that leverages legitimate firmware update mechanisms in car head units to establish a proxy botnet. The malware, dubbed BADBOX by researchers, was first identified in June 2026 and represents the first documented instance of malware specifically targeting automotive infotainment systems through their native update channels.
Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
A novel malware family has been identified that specifically targets Android-based car head units, utilizing their built-in firmware update mechanisms for propagation. This sophisticated threat, reportedly linked to the MoYu Group, is designed to engage in ad fraud and to establish a proxy botnet. This marks a significant development as it is described as the first documented instance of…
Android Malware Steals Payment Card Data via NFC
A new Android malware, dubbed WindRelay, has been identified as capable of intercepting live payment card data via Near Field Communication (NFC) and transmitting it to attackers in real time. Discovered by Group-IB researchers, WindRelay operates in conjunction with the SpyNote remote access trojan (RAT), which grants attackers control over a victim's device.
Gemini AI Flaw Lets Strangers Message From Locked Android Phones
A newly identified vulnerability in Google's Gemini AI assistant allows unauthorized individuals with physical access to a locked Android 16 smartphone to send messages via SMS and WhatsApp without needing to enter the device's security PIN. Google has confirmed awareness of the issue and stated that a fix is scheduled for release this week.
RedWing Android Spyware Sold as a Service on Telegram
Cybersecurity researchers have identified a new Android spyware strain, dubbed RedWing, being distributed as a malware-as-a-service (MaaS) through the Telegram messaging platform. This operation provides criminals with sophisticated tools to hijack mobile devices and steal sensitive banking credentials, even if they possess limited technical expertise. The RedWing MaaS is characterized by…
RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service
A new Malware-as-a-Service (MaaS) operation dubbed RedWing is offering sophisticated Android banking fraud tools through rental agreements facilitated via the Telegram messaging platform. This service provides cybercriminals with pre-packaged malware designed to compromise mobile devices, with the explicit aim of stealing sensitive banking information and one-time passcodes used for…
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique
Check Point Research has identified a novel ransomware technique that operates entirely within a web browser, bypassing the need for native malware installation or exploits. This "browser-only" ransomware leverages the File System Access API in Google Chrome, particularly on Android devices, to encrypt user files after tricking them into granting access.
Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool
A cyber-espionage group identified as TAG-182, believed to be operating on behalf of the Iranian government, is actively distributing a surveillance tool known as MarkiRAT. This malware is being disseminated through fake applications designed to mimic legitimate services like VPNs and media players, with the apparent aim of collecting intelligence on Iranian targets both within and outside the…
Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android
Google is taking steps to secure Android against the potential threat of quantum computing by integrating post-quantum cryptography (PQC) standards into the operating system. This initiative represents a multi-year effort to safeguard sensitive data and transactions that could be vulnerable to decryption by future quantum computers.