30
Android 17 adds new protections against sneaky Wi-Fi tracking and web snooping
Android 17 adds Encrypted Client Hello, Local Network Protection, default Certificate Transparency and operator-controlled 2G disabling to counter Wi-Fi tracking and snooping.
Google announced network security changes in Android 17, led by broad support for Encrypted Client Hello (ECH), which encrypts domain names visible to network operators and eavesdroppers, paired with GREASE decoys where server support is uneven. Jigsaw testing across the top 10,000 domains and 740 ISPs in 202 countries found connection success and interference levels comparable to ordinary TLS. Android 17 also adds Local Network Protection requiring app permission to scan local devices, Certificate Transparency on by default to catch forged certificates, and operator-side 2G disabling to cut exposure to SMS blaster fake base stations. Apps targeting Android 17 get ECH by default via networking libraries such as OkHttp, WebView and HttpEngine.
52
Your passkeys can now move between password managers on Android
Google enabled direct password and passkey transfers between Android password managers, initiated from the destination app without unencrypted file exports.
Android now supports moving passwords and passkeys directly between password managers without exporting them to a file, replacing the previous unencrypted-export workflow. The transfer is initiated in the receiving app, which hands off to Android to detect installed managers and request authorization in the source app. The feature works today with Google Password Manager, 1Password, Bitwarden, and Dashlane, with more partners promised but unnamed. Google says data moves between apps in seconds and calls the handoff secure, without detailing the protections.
25
30
30
30
Meta adds three new features to keep WhatsApp accounts secure
Meta strengthens WhatsApp account security with alphanumeric two-step verification passwords, unknown-caller context on Android, and multiple passkeys per account.
Meta upgraded WhatsApp's two-step verification from a six-digit PIN to a longer alphanumeric password that can include special characters. On Android, calls from unsaved numbers now show context such as whether the number is registered in another country or shares groups with the recipient, countering scam urgency. More than one billion users have set up passkeys, and users can now register multiple passkeys on one account across mixed platforms.
40
Microsoft Teams is about to make QR code phishing much harder
Microsoft Teams will obscure QR codes from external senders starting October 2026, adding friction against QR-code phishing across Android, desktop, iOS, and Mac.
Microsoft 365 Roadmap entry 570439 describes a Teams feature that obscures images containing QR codes sent by external users, requiring users to reveal them before viewing or scanning. Rollout is expected to begin in October 2026 for Android, desktop, iOS, and Mac. The feature aims to reduce QR code phishing risk, which NordVPN says has redirected more than 26 million users to malicious websites, with 73% of Americans scanning codes without verifying destinations.
25
WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign
Meta now allows multiple passkeys per WhatsApp account and upgraded two-step verification to full passwords, hardening sign-in for more than 1 billion users.
Meta announced support for multiple passkeys on a single WhatsApp account for iOS and Android, noting more than 1 billion people already use a passkey to log in. WhatsApp also upgraded two-step verification from a six-digit PIN to a full alphanumeric password and added Android call context such as origin location, contact status, and shared groups. The features aim to harden account sign-in against phishing and one-time passcode interception and to counter caller scams relying on urgency.
30
30
55
GrapheneOS' rewritten Messages app is released
GrapheneOS published version 13 of its rewritten Messaging app, a messaging tool from the privacy-hardened Android OS project.
GrapheneOS released version 13 of its rewritten Messaging application on GitHub. The release surfaced via a Hacker News thread with 61 points and 22 comments. The provided text contains only the release listing, with no vulnerability or exploit details; GrapheneOS is a privacy- and security-focused Android OS project, making the release relevant to mobile privacy tooling.
22
GrapheneOS Overhauled Default Apps and Secure Clipboard
GrapheneOS announced an overhaul of its default apps and a redesigned secure clipboard in its privacy-focused Android distribution.
The GrapheneOS project posted on Mastodon that it has "overhauled default apps and secure clipboard" in its privacy and security hardened Android OS. The provided text contains only the announcement title and engagement figures, without release notes or technical specifics. Changes to built-in apps and clipboard handling in GrapheneOS are typically relevant to Android privacy and mobile security practitioners.
40
30
Product showcase: mSecure makes one vault do more than remember passwords
Product showcase reviews mSecure password manager's AES-256 zero-knowledge vault with passkeys, 2FA storage, and multi-device sync options.
mSecure is a password manager and data vault for iOS, Android, macOS, and Windows using AES-256 encryption and a zero-knowledge architecture, with sync via mSecure Cloud, Wi-Fi, iCloud, or Dropbox, plus local-only storage. It supports passkeys, one-time passwords, a Security Center for weak/reused passwords, and a configurable password generator. Recovery features include two-factor authentication, auto-lock, a Self-Destruct option after failed unlock attempts, and iCloud backups on iOS.
12
BleachBit 6.0.4 fixes secure wiping that skipped clusters on Windows
BleachBit 6.0.4 fixes Windows secure-wipe bugs that skipped fragmented-file clusters, adds HSTS tracker deletion, early macOS support, and broad hardening.
The open-source cleaner BleachBit released version 6.0.4, fixing Windows shredding bugs where fragmented files were wiped incompletely because noncontiguous clusters were skipped, leaving potentially sensitive data on disk. The release adds deletion of dynamic HSTS tracking data in six Chromium-based browsers and Zen, early macOS support including a Safari cleaner and full CLI, plus hardening such as absolute paths for ipconfig/taskkill, symlink and reparse-point handling, DTD-free XML parsing, and PATH/environment sanitization when running as root.
26
Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates
ANY.RUN August release adds TI Lookup connections view, 81 behavior signatures, 16 YARA rules, 559 Suricata rules, and three new threat intelligence reports.
ANY.RUN released August product updates expanding its Threat Intelligence Lookup with a Connections block for pivoting between related observables (domains, IPs, URLs), JSON export for retrohunting and SIEM/NDR integration, and hidden whitelisted data by default. Detection coverage grew with 81 new behavior signatures, 16 YARA rules, and 559 Suricata rules covering malware execution, phishing, and C2 traffic. Three new Threat Intelligence Reports cover a US-focused RMM phishing campaign across 46 countries, the Mirage2FA phishing-as-a-service targeting Microsoft 365 (1,249 sandbox sessions, 9,332 potential compromise events), and a threat brief on OVERLORD RAT, CRPX0, and TRIBACK loader.
28
Keepnet launches free SMS/Call Reporter for iOS
Keepnet launched a free iOS app, SMS/Call Reporter, letting users one-tap report smishing and vishing into corporate incident response pipelines.
Keepnet released the free SMS/Call Reporter app for iOS, letting users report suspicious SMS and voice phishing with one tap. For enterprise customers, reports flow into Keepnet Incident Responder alongside email phishing reports. The company cites Verizon 2026 DBIR data showing mobile phishing simulations achieve a 40% higher median click rate than email, and FBI IC3 2025 counted $798 million in smishing and vishing losses. An Android version is planned.
22
30
55
30
42
42
30
30
55
30
30
30
30
30