TGViewer
Channel Public Channel
Android Security & Malware

Android Security & Malware

@androidmalware

Mobile cybersecurity channel
Links: https://linktr.ee/mobilehacker
Contact: mobilehackerofficial@gmail.com
Open in Telegram
Subscribers
44.8K
Photos
136
Videos
22
Links
2.9K

Showing posts older than #2260 · Back to latest

Older Posts 20 shown
Post #2258 8.52K
Monitor file system changes using fsmon
▪️supports Linux, iOS, OS X, Android
▪️identify when are binaries loaded (root)
▪️get dropped payloads (root)
▪️identify when are which files opened at app's runtime (db, txt, log, temp...) (non-root)
https://www.mobile-hacker.com/2024/06/24/monitoring-android-file-system-with-fsmon/
Mobile Hacker Monitoring Android file system with fsmon - Mobile Hacker fsmon is a FileSystem Monitor utility created by by Sergi Àlvarez at Nowsecure can run on Linux, Android, iOS, FireFox OS, and OS X. It retrieves file system events from a specific directory and displays them in a colorful format or in JSON. You can filter…
  • 👍 20
  • ❤ 2
Post #2257 8.24K
Android Rafel RAT - from Espionage to Ransomware Operations campaigns - attributed to APT-C-35 / DoNot Team APT group
https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Check Point Blog Rafel RAT, Android Malware from Espionage to Ransomware Operations - Check Point Blog When it comes to mobile devices, Android is the most popular and used operating system with over 3.9 billion active users in over 190 countries.
  • 👍 20
  • 👾 3
  • 👏 1
Post #2256 9.21K
Mobile OAuth Attacks - iOS URL Scheme Hijacking Revamped
30 popular apps, vulnerable to attack in which any installed iOS app from the Apple App Store could perform an account takeover of victim users
https://evanconnelly.github.io/post/ios-oauth/
Evan Connelly Mobile OAuth Attacks - iOS URL Scheme Hijacking Revamped Summary We (Julien Ahrens @MrTuxracer and myself @Evan_Connelly) identified nearly 30 popular apps, as well as a feature within iOS itself, vulnerable to an attack in which any installed iOS app from the Apple App Store could perform an account takeover of…
  • 👍 16
Post #2255 10.1K
NetHunter Hacker XVI: Metasploit payload generator in a pocket
https://www.mobile-hacker.com/2024/06/20/nethunter-hacker-xvi-metasploit-payload-generator-in-your-pocket/
Mobile Hacker NetHunter Hacker XVI: Metasploit payload generator in your pocket - Mobile Hacker Metasploit is a powerful and comprehensive framework that allows you to create, test, and execute exploits and payloads for various platforms and systems. It is one of the most widely used tools in the cybersecurity field. The NetHunter Metasploit Payload…
  • 👍 30
  • 💯 5
Post #2254 11.3K
Exfiltrate WhatsApp chat, or internal data of any Android app, running on Android 12 or 13 by exploiting CVE-2024-0044 vulnerability [video]
https://www.mobile-hacker.com/2024/06/17/exfiltrate-sensitive-user-data-from-apps-on-android-12-and-13-using-cve-2024-0044-vulnerability/
Mobile Hacker Exfiltrate sensitive user data from apps on Android 12 and 13 using CVE-2024-0044 vulnerability - Mobile Hacker With physical access to Android device with enabled ADB debugging running Android 12 or 13 before receiving March 2024 security patch, it is possible to access internal data of any user installed app by misusing CVE-2024-0044 vulnerability. Internal data…
  • 👍 38
  • ❤ 2
  • 👏 2
Post #2253 10.7K
Exploiting embedded mitel phones for unauthenticated remote code execution
Achieving a fully unauthenticated RCE exploit as root in a Mitel IP phone. Several 0-days were discovered which chained together gives the privilege of completely owning the phone
https://baldur.dk/blog/embedded-mitel-exploitation.html
  • 👍 19
  • ❤ 2
  • 👏 2
Post #2251 10.6K
Driving forward in Android drivers
Blog: https://googleprojectzero.blogspot.com/2024/06/driving-forward-in-android-drivers.html
Presentation: https://archive.org/details/shmoocon2024/Shmoocon2024-SethJenkins-Driving_Forward_in_Android_Drivers.mp4
Proof of concept exploit code(CVE-2023-32832): https://bugs.chromium.org/p/project-zero/issues/detail?id=2470#c4
projectzero.google Driving forward in Android drivers Posted by Seth Jenkins, Google Project ZeroIntroduction Android's open-source ecosystem has ...
  • 👍 23
Post #2250 8.81K
Operation Celestial Force employs mobile and desktop malware to target Indian entities (GravityRAT, HeavyLift)
https://blog.talosintelligence.com/cosmic-leopard/
Cisco Talos Operation Celestial Force employs mobile and desktop malware to target Indian entities Cisco Talos is disclosing a new malware campaign called “Operation Celestial Force” running since at least 2018. It is still active today, employing the use of GravityRAT, an Android-based malware, along with a Windows-based malware loader we track as “HeavyLift.”
  • ❤ 16
  • 🔥 2
  • 👍 1
Post #2249 8.25K
Five campaigns targeting Android users in Egypt and Palestine, most probably operated by the Arid Viper APT group. Three of the campaigns are active, distributing Android spyware AridSpy via dedicated websites
https://www.welivesecurity.com/en/eset-research/arid-viper-poisons-android-apps-with-aridspy/
Welivesecurity Arid Viper poisons Android apps with AridSpy ESET research has discovered Arid Viper espionage campaigns that deploy multistage Android spyware and target people in Egypt and Palestine.
  • 👍 15
Post #2246 7.87K
Wpeeper: New Android malware hides behind hacked WordPress sites
https://blog.xlab.qianxin.com/playing-possum-whats-the-wpeeper-backdoor-up-to/
奇安信 X 实验室 Playing Possum: What's the Wpeeper Backdoor Up To? Summary On April 18, 2024, XLab's threat hunting system detected an ELF file with zero detections on VirusTotal being distributed through two different domains. One of the domains was marked as malicious by three security firms, while the other was recently…
  • 👍 16
Post #2245 13.6K
Android (on device) fuzzing using AFL++ Frida Mode
Blog: https://knifecoat.com/Posts/Fuzzing+Redux%2C+leveraging+AFL%2B%2B+Frida-Mode+on+Android+native+libraries
AFL++ Frida Mode Build: https://github.com/FuzzySecurity/afl-frida-build
KnifeCoat Fuzzing Redux, leveraging AFL++ Frida-Mode on Android native libraries - KnifeCoat Intro Welcome fellow antiquarians, after detouring a little bit on the app layer we are back to the native layer. Both parts are very important for Android userland of course. The apps provide intera…
  • 🔥 21
  • 👍 1
Post #2243 11K
Becoming any Android app via Zygote command injection (CVE-2024-31317)
https://rtx.meta.security/exploitation/2024/06/03/Android-Zygote-injection.html
Meta Red Team X Becoming any Android app via Zygote command injection We have discovered a vulnerability in Android that allows an attacker with the WRITE_SECURE_SETTINGS permission, which is held by the ADB shell and certain privileged apps, to execute arbitrary code as any app on a device. By doing so, they can read and write…
  • 🔥 33
  • 👍 3
  • ❤ 1
Post #2241 10.8K
Android Universal Root
Rooting Pixel 6 and 7 Pro running Android 13 👇
Analysis and Exploitation of CVE-2023-20938 (exploit a use-after-free vulnerability to elevate privileges to root and disable SELinux)
[blog] https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/
[slides] https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/offensivecon_24_binder.pdf
[PoC demo] https://www.youtube.com/watch?v=7qFb6RUHnnU
Withgoogle Attacking Android Binder: Analysis and Exploitation of CVE-2023-20938 - Android Offensive Security Blog At OffensiveCon 2024, the Android Red Team gave a presentation (slides) on finding and exploiting CVE-2023-20938, a use-after-free vulnerability in the Android Binder device driver. This post will provide technical details about this vulnerability and how…
  • 👍 20
  • ❤ 1
  • 🔥 1
Post #2240 9.44K
Fake Bahrain Government Android App Steals Personal Data Used for Financial Fraud
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fake-bahrain-government-android-app-steals-personal-data-used-for-financial-fraud/
McAfee Blog Fake Bahrain Government Android App Steals Personal Data Used for Financial Fraud | McAfee Blog Authored by Dexter Shin Many government agencies provide their services online for the convenience of their citizens. Also, if this service could be
  • 🔥 18
  • 👍 4
Older posts →
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →