ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Android”

37 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 1865Vulnerability 1050Exploit / PoC 581Ransomware 449Phishing & fraud 340Industry 289Data breach 258Policy & legal 232Threat actor 203Research 126Tools 31Advisory 28
SeverityAllcritical 1737high 1399medium 1566low 711info 39

Top 10 Best Mobile Device Management (MDM) Solutions in 2026

A 2026 MDM buyer guide ranks ten solutions, recommending Microsoft Intune for Microsoft 365 estates and Jamf for Apple-only environments.

A 2026 buyer guide evaluates ten mobile device management solutions, leading with Microsoft Intune as the default for Microsoft 365 organizations and Jamf for Apple estates. It recommends choosing the enrolment model before selecting a vendor and clarifying BYOD visibility to prevent privacy disputes. Kandji, Mosyle, Omnissa Workspace ONE, ManageEngine, Scalefusion, and Hexnode are covered as alternatives. Guidance ties MDM to Zero Trust data access policies via Apple User Enrolment and Android work profiles.

Cyber Security News · 7d agoIndustry

Top 10 Best Unified Endpoint Management (UEM) Solutions in 2026

A 2026 buyer's guide ranks UEM platforms, recommending Intune for Microsoft 365 shops, Jamf for Apple estates, and SOTI for rugged devices.

The guide ranks ten unified endpoint management platforms for 2026, recommending Microsoft Intune for Microsoft 365 organizations, Jamf for Apple-heavy estates, and SOTI for rugged, kiosk, and industrial devices. It notes VMware Workspace ONE now operates as Omnissa after Broadcom divested the End-User Computing division, and that BlackBerry sold Cylance to Arctic Wolf in February 2025 while retaining BlackBerry UEM. The article provides a coverage checklist spanning Windows, macOS, iOS, Android, Linux, kiosks, legacy on-prem Windows, and wearables/IoT.

Cyber Security News · 7d agoIndustry

Android 17 adds new protections against sneaky Wi-Fi tracking and web snooping

Android 17 adds Encrypted Client Hello, Local Network Protection, default Certificate Transparency and operator-controlled 2G disabling to counter Wi-Fi tracking and snooping.

Google announced network security changes in Android 17, led by broad support for Encrypted Client Hello (ECH), which encrypts domain names visible to network operators and eavesdroppers, paired with GREASE decoys where server support is uneven. Jigsaw testing across the top 10,000 domains and 740 ISPs in 202 countries found connection success and interference levels comparable to ordinary TLS. Android 17 also adds Local Network Protection requiring app permission to scan local devices, Certificate Transparency on by default to catch forged certificates, and operator-side 2G disabling to cut exposure to SMS blaster fake base stations. Apps targeting Android 17 get ECH by default via networking libraries such as OkHttp, WebView and HttpEngine.

Help Net Security · 20d agoTools

Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers

Google announced Android 17 will enforce OS-wide Encrypted Client Hello with ECH GREASE, plus Certificate Transparency by default and carrier 2G disablement.

Google announced Android 17 network security protections headlined by OS-wide support for Encrypted Client Hello (ECH), with ECH GREASE enabled by default so connections to non-ECH servers look identical. Google's Jigsaw noted OkHttp has integrated ECH, letting third-party Android apps adopt the standard. The release also enforces Local Network Protection permission prompts, enables Certificate Transparency by default, and lets carriers turn off 2G by default to prevent downgrade attacks, rogue base stations, and SMS blasters. ECH was previously added to Chrome 117 and Firefox 118 at the browser level only.

The Hacker News · 19d agoAdvisory

Your passkeys can now move between password managers on Android

Google enabled direct password and passkey transfers between Android password managers, initiated from the destination app without unencrypted file exports.

Android now supports moving passwords and passkeys directly between password managers without exporting them to a file, replacing the previous unencrypted-export workflow. The transfer is initiated in the receiving app, which hands off to Android to detect installed managers and request authorization in the source app. The feature works today with Google Password Manager, 1Password, Bitwarden, and Dashlane, with more partners promised but unnamed. Google says data moves between apps in seconds and calls the handoff secure, without detailing the protections.

Help Net Security · 6d agoTools

ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories

Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.

Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.

The Hacker News · 6d agoIndustry in the wild

Top 10 Best Mobile Threat Defense (MTD) Solutions in 2026

Roundup of 2026 mobile threat defense tools recommends Zimperium and Lookout for targeted-attack detection and Defender for Endpoint for Microsoft shops.

This guide ranks ten mobile threat defense solutions, recommending Zimperium and Lookout for on-device detection against targeted users such as executives and journalists, and Microsoft Defender for Endpoint mobile for organizations already licensing Microsoft 365 E5. It explains that MDM enforces configuration while MTD detects attacks, and that mobile phishing now arrives via SMS, messaging apps and QR codes rather than email. It also highlights mercenary spyware and zero-click exploits as shifting requirements for high-risk users, referencing Apple's threat-notification program and Lockdown Mode.

Cyber Security News · 7d agoIndustry

The 12 Best Mobile Threat Defense (MTD) Solutions, Compared and Priced

A comparison of 12 mobile threat defense vendors highlights Zimperium's on-device detection and notes Kaspersky's US exit and Wandera's Jamf absorption.

The buyer's guide compares 12 mobile threat defense (MTD) products, naming Zimperium best for fully on-device detection and Microsoft Defender for Endpoint as the best-value bundled option. It reminds readers that Kaspersky cannot legally be sold or updated in the US following a Commerce Department determination, and that Wandera was acquired by Jamf. Most MTD pricing is quote-based per device or per user.

GBHackers · 6d agoIndustry 4 sources

Your phone or computer may soon ask how old you are

California's Digital Age Assurance Act forces Windows, macOS, iOS, and Android to collect age brackets from January 2027, with open-source exemptions pending.

California's Digital Age Assurance Act, signed in October 2025, requires major operating systems to collect user age brackets (under 13, 13-15, 16-17, 18+) and share non-identifying age signals with app developers starting January 1, 2027, with existing setups complying by July 1, 2027. AB1856, passed in late August 2026, would exempt open-source operating systems under GPL, MIT, BSD, and Apache licenses and awaits the governor's signature. Colorado, Illinois, and New York have similar age assurance measures, and the EFF has criticized the law for privacy and censorship concerns.

Malwarebytes Labs · 13d agoPolicy & legal

Risky Bulletin: Dutch intel services to get extensive new powers

Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.

The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.

Risky Business News · 17d agoPolicy & legal

Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited

Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.

The roundup reports at least 274 internet-facing Zimbra instances compromised via CVE-2026-73570, critical Gitea CVE-2026-60004 added to CISA's KEV catalog after exploitation began, and previously patched Citrix NetScaler flaw CVE-2026-8452 exploited in the wild. It also covers PaperCut NG/MF zero-day attacks, a suspected Iran-linked shutdown of a UK power plant, an FBI seizure of domains tied to a China-linked group that hit NASA, DOJ and the Senate, a cyberattack disrupting Boston Scientific, and the Manchester Airports Group breach. Additional items include Chameleon SEO poisoning phishing, Android car head unit proxy botnet malware, ReliaQuest social engineering by ShinyHunters, fake OpenAI Codex macOS malware, and AI-related workforce and supply chain interviews.

Help Net Security · 18d agoIndustry in the wildCVE-2026-73570CVE-2026-60004CVE-2026-8452

WhatsApp Adds Stronger Security as Passkeys Hit 1 Billion

WhatsApp says 1 billion users now use passkeys, as it upgrades two-step verification to full passwords and adds context for calls from unknown numbers.

WhatsApp announced that more than 1 billion users now protect their accounts with passkeys, and that users can now add multiple passkeys across Android and iOS devices. The app's two-step verification has been upgraded from a six-digit PIN to a full alphanumeric password with special characters, strengthening protection against account takeover. On Android, callers outside a user's contacts will now show context such as country of origin and shared groups, countering urgency-driven scam calls.

Security Affairs · 21d agoIndustry

Meta adds three new features to keep WhatsApp accounts secure

Meta strengthens WhatsApp account security with alphanumeric two-step verification passwords, unknown-caller context on Android, and multiple passkeys per account.

Meta upgraded WhatsApp's two-step verification from a six-digit PIN to a longer alphanumeric password that can include special characters. On Android, calls from unsaved numbers now show context such as whether the number is registered in another country or shares groups with the recipient, countering scam urgency. More than one billion users have set up passkeys, and users can now register multiple passkeys on one account across mixed platforms.

Help Net Security · 22d agoTools

Microsoft Teams is about to make QR code phishing much harder

Microsoft Teams will obscure QR codes from external senders starting October 2026, adding friction against QR-code phishing across Android, desktop, iOS, and Mac.

Microsoft 365 Roadmap entry 570439 describes a Teams feature that obscures images containing QR codes sent by external users, requiring users to reveal them before viewing or scanning. Rollout is expected to begin in October 2026 for Android, desktop, iOS, and Mac. The feature aims to reduce QR code phishing risk, which NordVPN says has redirected more than 26 million users to malicious websites, with 73% of Americans scanning codes without verifying destinations.

Help Net Security · 13d agoTools1

WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign

Meta now allows multiple passkeys per WhatsApp account and upgraded two-step verification to full passwords, hardening sign-in for more than 1 billion users.

Meta announced support for multiple passkeys on a single WhatsApp account for iOS and Android, noting more than 1 billion people already use a passkey to log in. WhatsApp also upgraded two-step verification from a six-digit PIN to a full alphanumeric password and added Android call context such as origin location, contact status, and shared groups. The features aim to harden account sign-in against phishing and one-time passcode interception and to counter caller scams relying on urgency.

The Hacker News · 22d agoTools

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News · 27d agoResearch2

Cybersecurity jobs available right now: June 16, 2026

Help Net Security rounds up cybersecurity job openings at Boeing, Lockheed Martin, Siemens Energy, and other firms across the US, Europe, India, and Israel.

Help Net Security's June 16, 2026 roundup lists cybersecurity job openings including Android vulnerability researcher, application security engineer, vulnerability management specialist, DevSecOps engineer, and OT/ICS consultant. Employers include Byteria, Millennium, Nava, Siemens Energy, Lockheed Martin, Enterprise Products, Audubon Companies, Boeing, and General Dynamics across the US, Ireland, Germany, India, Israel, and the UK.

Help Net Security · Aug 17, 2026Industry

Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day

Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.

Help Net Security's week in review aggregates top stories: a 'City-Forum' campaign tracked by Reco has been pulling records from Salesforce and ServiceNow portals worldwide for 17 months, and Framework suffered a breach via an exploited Metabase zero-day exposing customer contact and IP data. It also covers Microsoft's August 2026 Patch Tuesday fixing 400+ flaws including exploited zero-day CVE-2026-68820, Cisco's fix for exploited firewall DoS bug CVE-2026-20349 (added to CISA KEV), and a second N-able N-central hotfix for actively exploited CVE-2026-18577. Other items include GitHub expanding Dependabot malware alerts to eight package ecosystems and EU AI Act enforcement beginning on 2 August 2026.

Help Net Security · Aug 16, 2026Industry in the wildCVE-2026-18577CVE-2026-68820CVE-2026-203491

GrapheneOS' rewritten Messages app is released

GrapheneOS published version 13 of its rewritten Messaging app, a messaging tool from the privacy-hardened Android OS project.

GrapheneOS released version 13 of its rewritten Messaging application on GitHub. The release surfaced via a Hacker News thread with 61 points and 22 comments. The provided text contains only the release listing, with no vulnerability or exploit details; GrapheneOS is a privacy- and security-focused Android OS project, making the release relevant to mobile privacy tooling.

Hacker News · AI · 5d agoToolsHN 61↑ · 22 comments1

ANY.RUN Secures Leader Status in G2’s Malware Analysis Rankings

ANY.RUN announced G2 Fall 2026 Grid Leader and Momentum Leader recognition in the malware analysis category, citing 700,000+ users.

ANY.RUN announced it was named both Grid Leader and Momentum Leader in G2's Fall 2026 malware analysis rankings, citing customer satisfaction and market momentum. The vendor states its Interactive Sandbox is used by over 700,000 security professionals and 16,000+ SOC and MSSP teams across Windows, Linux, macOS, and Android. It also cites claimed efficiency gains, including faster investigations for 95% of SOCs and MTTR reductions of up to 21 minutes per case.

ANY.RUNupdated · 13h agofirst · 6d agoIndustry 2 sources1

The 12 Best Antivirus Software for Mac, Compared and Priced

GBHackers ranks 12 Mac antivirus products, naming Bitdefender best overall and noting Gen Digital owns Norton, Avast, and Avira.

GBHackers scored twelve Mac antivirus products, ranking Bitdefender first at 8.8/10, followed by Intego, Malwarebytes, and ESET. The piece highlights that Gen Digital owns Norton, Avast, and Avira following the NortonLifeLock-Avast merger, so three of the twelve options share one corporate owner. It advises comparing year-two renewal prices rather than discounted first-year pricing and notes macOS already ships XProtect, Gatekeeper, and automatic malware removal. The 2026 Mac threat model described is infostealers harvesting passwords, cookies, and wallets via cracked software, fake installers, and malicious search ads.

GBHackers · 7d agoIndustry 2 sources

Automobile Camouflage to Hide from Flock Cameras

Schneier on Security highlights a printed vehicle-camouflage pattern tested to defeat Flock surveillance cameras and Axon body cameras.

The post discusses covering cars with printed patterns designed to fool Flock automated license-plate recognition software, with testing reportedly done against Flock and Axon body cameras. Reader comments question effectiveness against other ALPR vendors, Flock's RF MAC-address upgrade, and whether such camouflage might become regulated. The page also contains off-topic comment threads about anti-bot over-blocking and privacy.

Schneier on Security · 9d agoResearch

GrapheneOS Overhauled Default Apps and Secure Clipboard

GrapheneOS announced an overhaul of its default apps and a redesigned secure clipboard in its privacy-focused Android distribution.

The GrapheneOS project posted on Mastodon that it has "overhauled default apps and secure clipboard" in its privacy and security hardened Android OS. The provided text contains only the announcement title and engagement figures, without release notes or technical specifics. Changes to built-in apps and clipboard handling in GrapheneOS are typically relevant to Android privacy and mobile security practitioners.

Hacker News · security · 10d agoToolsHN 404↑ · 257 comments

Cybersecurity jobs available right now: March 31, 2026

Help Net Security's job roundup lists cybersecurity vacancies worldwide, from malware research director to SOC, IAM, and GRC roles, mostly already closed.

The roundup aggregates cybersecurity openings across Israel, Ireland, India, the UK, Australia, France, Germany, Canada, the US and the UAE. Roles include Android malware research director, cloud security engineer, IAM analyst, SOC lead, GRC specialist, and vulnerability management positions at employers such as Iceland Foods, Pernod Ricard, A10 Networks, and TOMRA. Most listings were marked as no longer accepting applications at publication.

Help Net Security · 19d agoIndustry

12 Best CASB Solutions Compared (2026): Features & Pricing

GBHackers' 2026 buyer's guide compares 12 CASB-capable vendors, arguing standalone CASB pricing has dissolved into per-user SSE subscriptions.

The article evaluates twelve CASB-capable platforms including Microsoft Defender for Cloud Apps, Palo Alto Networks' Prisma Access CASB, Netskope, iboss, Forcepoint ONE (Bitglass), Trend Micro Cloud App Security, and Skyhigh Security. It frames purchasing around SSE bundle economics, noting Defender for Cloud Apps ships inside Microsoft 365 E5 while Netskope, Zscaler, and Skyhigh price CASB into per-user SSE tiers. It also flags Saviynt, common on legacy roundups, as an IGA vendor rather than a true CASB.

GBHackersupdated · 18h agofirst · 21h agoIndustry 14 sources

6 Months on Alert: Get H1 2026 Cyber Risk Report for SOCs and MSSPs

ANY.RUN's H1 2026 report details 15 threat trends including 437% growth in fake CAPTCHA phishing and 90.7% rise in Adobe infrastructure abuse.

The report draws on interactive sandbox submissions from over 700,000 analysts and 16,000 SOC teams between January and June 2026. Attacks abusing Adobe infrastructure grew 90.7% versus H2 2025 while RMM-related attacks rose 26.5%, and custom fake CAPTCHA phishing grew 437% from Q1 to Q2 2026. ANY.RUN argues static IOCs are losing effectiveness as dead drop resolvers hide the final C2 until execution.

ANY.RUN · 1d agoResearch

Product showcase: mSecure makes one vault do more than remember passwords

Product showcase reviews mSecure password manager's AES-256 zero-knowledge vault with passkeys, 2FA storage, and multi-device sync options.

mSecure is a password manager and data vault for iOS, Android, macOS, and Windows using AES-256 encryption and a zero-knowledge architecture, with sync via mSecure Cloud, Wi-Fi, iCloud, or Dropbox, plus local-only storage. It supports passkeys, one-time passwords, a Security Center for weak/reused passwords, and a configurable password generator. Recovery features include two-factor authentication, auto-lock, a Self-Destruct option after failed unlock attempts, and iCloud backups on iOS.

Help Net Security · 1d agoTools1

WhatsApp Restricted Chat locks a conversation to your primary phone

WhatsApp is developing Restricted Chat, a per-chat setting blocking conversation sync to linked devices, defeating third-party clients and AI agents.

Restricted Chat, spotted in Android beta version 2.26.36.5 but not yet enabled, keeps a chosen conversation exclusively on the primary phone, out of reach of WhatsApp Web and linked secondary devices. It extends Advanced Chat Privacy controls: media is not auto-saved to gallery, export is blocked, and messages cannot be handed to Meta AI, with system messages notifying participants of changes. WhatsApp has not announced a release date.

Help Net Security · 2d agoIndustry

Cliff Stoll’s DEF CON Talk

Schneier on Security posts about Cliff Stoll's DEF CON talk; the visible text provides no substantive details about its content.

Schneier on Security published a brief post referencing Cliff Stoll's talk at DEF CON. The available text consists almost entirely of standard blog navigation, author biography, and archive listings, with no concrete details about the talk itself. As a general security-community item, it carries no direct risk impact for defenders.

Schneier on Securityupdated · 5d agofirst · 5d agoIndustry 2 sources1

BleachBit 6.0.4 fixes secure wiping that skipped clusters on Windows

BleachBit 6.0.4 fixes Windows secure-wipe bugs that skipped fragmented-file clusters, adds HSTS tracker deletion, early macOS support, and broad hardening.

The open-source cleaner BleachBit released version 6.0.4, fixing Windows shredding bugs where fragmented files were wiped incompletely because noncontiguous clusters were skipped, leaving potentially sensitive data on disk. The release adds deletion of dynamic HSTS tracking data in six Chromium-based browsers and Zen, early macOS support including a Safari cleaner and full CLI, plus hardening such as absolute paths for ipconfig/taskkill, symlink and reparse-point handling, DTD-free XML parsing, and PATH/environment sanitization when running as root.

Help Net Security · 8d agoTools

Chrome is now shipping updates every 2 weeks as AI changes the security landscape

Google switches Chrome to two-week release cycles starting with Chrome 153, shrinking the N-day patch gap as AI-driven threats accelerate.

Chrome officially moved from a four-week to a two-week release schedule with Tuesday's launch of Chrome 153 on desktop, iOS, and Android. Google ties the change to its evolving security strategy, saying faster releases shrink the N-day patch gap as AI tools and community bug reports increase patch volume. Mozilla, Microsoft, and Brave have already adopted the two-week cadence, and Google is also racing AI-native browsers like Brave, Dia, Opera Neon, and Perplexity's Comet while experimenting with AI features in Chrome.

TechCrunch · Security · 8d agoIndustry

AVP-Inspect: Coordinated Cyber-Physical Testing for Privacy Analysis of COTS Apple Vision Pro Applications

AVP-Inspect automated testing finds 58% of 324 Apple Vision Pro apps show privacy violations, with over 60% of network traffic flows undisclosed.

Researchers built AVP-Inspect, a dynamic analysis framework combining custom hardware device control, 3D UI exploration, and a unified privacy taxonomy for Apple Vision Pro. Testing 324 App Store apps for 20 minutes each found 188 (58.0%) with at least one privacy violation. More than 60% of observed network traffic flows were not properly disclosed, extending prior XR privacy work beyond Android-based devices such as Meta Quest.

arXiv cs.CR · 9d agoResearch1

Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates

ANY.RUN August release adds TI Lookup connections view, 81 behavior signatures, 16 YARA rules, 559 Suricata rules, and three new threat intelligence reports.

ANY.RUN released August product updates expanding its Threat Intelligence Lookup with a Connections block for pivoting between related observables (domains, IPs, URLs), JSON export for retrohunting and SIEM/NDR integration, and hidden whitelisted data by default. Detection coverage grew with 81 new behavior signatures, 16 YARA rules, and 559 Suricata rules covering malware execution, phishing, and C2 traffic. Three new Threat Intelligence Reports cover a US-focused RMM phishing campaign across 46 countries, the Mirage2FA phishing-as-a-service targeting Microsoft 365 (1,249 sandbox sessions, 9,332 potential compromise events), and a threat brief on OVERLORD RAT, CRPX0, and TRIBACK loader.

ANY.RUN · 13d agoTools1

Keepnet launches free SMS/Call Reporter for iOS

Keepnet launched a free iOS app, SMS/Call Reporter, letting users one-tap report smishing and vishing into corporate incident response pipelines.

Keepnet released the free SMS/Call Reporter app for iOS, letting users report suspicious SMS and voice phishing with one tap. For enterprise customers, reports flow into Keepnet Incident Responder alongside email phishing reports. The company cites Verizon 2026 DBIR data showing mobile phishing simulations achieve a 40% higher median click rate than email, and FBI IC3 2025 counted $798 million in smishing and vishing losses. An Android version is planned.

Help Net Security · 15d agoTools

Risky Bulletin: Russia starts blocking DoH and DoT

Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.

Russian internet users began reporting failures connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two privacy protocols. The blocks reportedly cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 resolvers; Roskomnadzor has not officially confirmed the action. The agency tested a similar block in March on Beeline's network and had named DoH for blocking as early as 2021. The bulletin also briefly notes state-sponsored phishing of EU officials, a DDoS against Norway's Digdir, the ReliaQuest/ShinyHunters dispute, and older ransomware and breach disclosures.

Risky Business News · 22d agoPolicy & legal1

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

A weekly bulletin aggregating short security updates, including the City-Forum data-theft campaign, a ShipMonk breach, a Cursor CLI flaw, and GhostJacking AI attacks.

The Hacker News ThreatsDay Bulletin bundles roughly 20 short updates across cloud services, AI tools, malware, breaches, and scams. Highlights include the City-Forum campaign pulling data from unauthenticated guest access in Salesforce Experience Cloud and ServiceNow Service Portals since March 2025, and a ShipMonk breach exposing Trezor customer order data for orders in seven countries between May 10 and August 8, 2026. Other items cover a patched Cursor CLI flaw that let cloned repositories run commands before the workspace-trust prompt, Okta's analysis of the Work Panel vishing console used by actors like UNC6671, and GhostJacking AI agent hijacking via a patched Claude Desktop sandbox escape. Meta also launched an on-device WhatsApp Scam Alert machine learning model that keeps message content on the device.

The Hacker News · 29d agoIndustry

American Being Prosecuted for Wiping His Phone Before Handing It Over to Border Officials

A U.S. citizen is being prosecuted for using GrapheneOS's duress passcode to wipe his phone before border officials could search it.

Tunick entered a dedicated wipe passcode in GrapheneOS, a hardened Android alternative running on his Google Pixel, erasing the device's contents when demanded by border officials. His attorneys confirmed the software was in use, and the prosecution is proceeding even though he was not under arrest. The case raises unresolved constitutional questions about what rights apply at the U.S. border, which the government has long treated as outside U.S. soil until entry is authorized. GrapheneOS publicly asserted the feature is legal and that laws weakening its protections would be unconstitutional.

Schneier on Security · Aug 13, 2026Policy & legal