Search: “android-17”

Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks

Google patched CVE-2026-58704, an actively exploited Android zero-day allowing proximal privilege escalation via the Pixel cellular modem, urging the 2026-09-05 patch.

Google confirmed CVE-2026-58704, a high-severity elevation-of-privilege flaw in the Pixel cellular modem, is being exploited in limited, targeted attacks and shipped emergency fixes in the September 2026 Pixel Update Bulletin. The low-complexity bug requires no user interaction and enables proximal/adjacent privilege escalation with no additional execution privileges, phrasing Google has historically used for spyware-vendor and state-aligned zero-days. The Pixel bulletin patches 110 flaws including 12 critical RCEs, while the broader September Android update addressed roughly 180 vulnerabilities, including Wi-Fi memory-corruption bug CVE-2026-28662.

Cyber Security News·updated 17:56 UTC · 5h ago·first 09:40 UTC · 13h agoExploit / PoC in the wild 8 sourcesCVE-2026-58704CVE-2026-28662

Android 17 adds new protections against sneaky Wi-Fi tracking and web snooping

Android 17 adds Encrypted Client Hello, Local Network Protection, default Certificate Transparency and operator-controlled 2G disabling to counter Wi-Fi tracking and snooping.

Google announced network security changes in Android 17, led by broad support for Encrypted Client Hello (ECH), which encrypts domain names visible to network operators and eavesdroppers, paired with GREASE decoys where server support is uneven. Jigsaw testing across the top 10,000 domains and 740 ISPs in 202 countries found connection success and interference levels comparable to ordinary TLS. Android 17 also adds Local Network Protection requiring app permission to scan local devices, Certificate Transparency on by default to catch forged certificates, and operator-side 2G disabling to cut exposure to SMS blaster fake base stations. Apps targeting Android 17 get ECH by default via networking libraries such as OkHttp, WebView and HttpEngine.

Help Net Security·Aug 28, 00:00 UTC · 19d agoTools

Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers

Google announced Android 17 will enforce OS-wide Encrypted Client Hello with ECH GREASE, plus Certificate Transparency by default and carrier 2G disablement.

Google announced Android 17 network security protections headlined by OS-wide support for Encrypted Client Hello (ECH), with ECH GREASE enabled by default so connections to non-ECH servers look identical. Google's Jigsaw noted OkHttp has integrated ECH, letting third-party Android apps adopt the standard. The release also enforces Local Network Protection permission prompts, enables Certificate Transparency by default, and lets carriers turn off 2G by default to prevent downgrade attacks, rogue base stations, and SMS blasters. ECH was previously added to Chrome 117 and Firefox 118 at the browser level only.

The Hacker News·Aug 28, 16:20 UTC · 19d agoAdvisory

Android Security Update September 2026 – Fix for Critical Flaws that Enable RCE Attacks

Google's September 2026 Android bulletin fixes over 30 critical flaws, including no-interaction system RCEs, a TIPC kernel RCE and a Qualcomm closed-source bug

Google's Android Security Bulletin for September 2026 (patch levels 2026-09-01 and 2026-09-05) fixes numerous critical System remote code execution flaws, including CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662, CVE-2026-49882, CVE-2026-49884, CVE-2026-49919 and CVE-2026-49921, none requiring user interaction or additional privileges. It also addresses critical kernel issues including a TIPC RCE (CVE-2026-52993) and elevation-of-privilege flaws in NFC and protected KVM, plus a critical Qualcomm closed-source component flaw (CVE-2026-25289). Affected versions span Android 14 through 17; the 2026-09-05 patch level extends coverage to Android TV and chipset components, with high-severity fixes for Arm Mali, PowerVR, MediaTek, Unisoc and Qualcomm components.

Cyber Security News·Sep 9, 13:44 UTC · 7d agoAdvisoryCVE-2026-28666CVE-2026-55273CVE-2026-49932+27 CVEs

Android security advisory – September 2026 monthly rollup (AV26-920)

Canadian Cyber Centre relays Android's September 2026 security bulletin, urging users and administrators to apply device updates.

The Canadian Centre for Cyber Security issued advisory AV26-920 pointing to the Android security bulletin published September 8, 2026. Users and administrators are encouraged to review the linked bulletin and apply necessary updates as they become available. The alert itself lists no specific CVEs, affected components, or exploitation details.

Canadian Centre for Cyber Security·Sep 14, 17:27 UTC · 2d agoAdvisory

Android’s September 2026 Updates Patch 180 Vulnerabilities

Google's September 2026 Android security updates patch 180 vulnerabilities including critical Wi-Fi memory corruption flaw CVE-2026-28662.

Google released September 2026 Android security updates addressing 180 vulnerabilities across two patch levels. The 2026-09-01 level fixes 95 bugs including 23 critical System component flaws enabling RCE, EoP, and DoS. The 2026-09-05 level addresses 85 additional defects in kernel and vendor components including a Wi-Fi memory corruption flaw (CVE-2026-28662) enabling remote code execution without privileges or user interaction.

SecurityWeek·Sep 9, 16:30 UTC · 7d agoAdvisoryCVE-2026-28662

THost9 Android RAT Pairs Packed Loader With ADB Worm

Dark Atlas details THost9, a packed Android RAT paired with an ADB worm that installs itself on devices with exposed Android Debug Bridge services.

Dark Atlas researchers described the Hagaseca cluster, whose THost9 packed loader hides executable code in an embedded asset decoded with single-byte XOR and gzip before loading a tc9.dex second stage. The second stage adds shell execution, file transfer, tunneling, reverse shells, downloadable modules and a self-propagating ADB worm that expands single addresses into 65,025-host scan ranges. Newer builds include anti-analysis checks for Frida, and incident reports connect THost9 and THost4 to Android phones and Redroid containers with exposed ADB from October 2024 through 2026.

Infosecurity Magazine·Sep 8, 11:15 UTC · 8d agoMalware in the wild

MantaxOtax Android Malware Combines Ransomware With Spyware

Zimperium analyzed MantaxOtax Android malware combining AES file encryption with extensive spying, linked to Indonesian actors and distributed via sideloading.

Zimperium's zLabs published a technical analysis of MantaxOtax, an Android malware family that combines ransomware-style file encryption with comprehensive spyware, linked to Indonesian threat actors and distributed via sideloaded APKs on a third-party file-sharing service. The malware requests device administrator, SMS, contacts, storage and Accessibility permissions, resolves its C2 domain dynamically from a GitHub repository, and encrypts files with AES using per-device keys derived from the Android ID on Android 9 and earlier. It steals WhatsApp messages, Telegram credentials, OTPs and other data, and uses MediaProjection for screenshots and screen recording staged on Catbox; a second variant adds WebSocket C2 with persistent screen locking and app blocking.

Infosecurity Magazine·Sep 10, 13:00 UTC · 6d agoMalware

Q2 2026 Android threat landscape

Kaspersky Securelist·Aug 10, 09:40 UTC · Aug 10, 2026Ransomware

Android Malware Hijacks Update System for Car Head Units

A click-fraud botnet crew now deploys Android malware to car head-unit infotainment systems by abusing the legitimate software update mechanism.

Threat actors behind a notorious Android click-fraud botnet are targeting vehicle infotainment head units, according to Dark Reading. The malware abuses legitimate update functionality to install and spread infections. The campaign highlights automotive Android systems as an emerging attack surface for established mobile botnet operators.

Dark Reading·Aug 26, 17:33 UTC · 21d agoMalware in the wild

Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone

Citizen Lab and SHARE Foundation confirm a Serbian student activist's iPhone was infected with NSO Group Pegasus via a zero-click iMessage exploit.

Forensic analysis found high-confidence infection indicators on the activist's iPhone during December 2025 and January 2026, using an iMessage zero-click exploit the Citizen Lab believes was patched as of iOS 18.4.1, released April 2025. The target was among at least 14 Apple Threat Notification recipients in Serbia's student movement, civil society, and opposition politics documented by the SHARE Foundation. Targeting occurred ahead of key 2026 election cycles; Amnesty Tech also confirmed a new NoviSpy version on another student movement member's device.

Infosecurity Magazine·Sep 3, 15:25 UTC · 13d agoThreat actor in the wild

ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories

The Hacker News·Aug 6, 15:24 UTC · Aug 6, 2026VulnerabilityCVE-2025-21079CVE-2025-584861

Flock cameras are riddled with security vulnerabilities and hardcoded credsnew

Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.

DDoSecrets published filesystem images from an in-use Flock ALPR camera, obtained by the hacker collective stegan0gram and investigated by 404 Media and Wired. Micah Lee's analysis shows the camera runs Android 8.1 with a security patch level of 2018-06-05 and Linux kernel 3.18.71, missing roughly eight years of Android fixes. The firmware exposes a hardcoded API key for Flock's hpnotiq backend that can retrieve Auth0 client credentials for any camera by MAC address, with credentials stored in plaintext. Likely unpatched flaws include CVE-2021-1905 (Qualcomm Adreno use-after-free) and CVE-2018-9568 (WrongZone kernel socket type confusion); Flock says it received no reports via its disclosure policy.

Hacker News · security·22:19 UTC · 53m agoVulnerability 3 sourcesHN 35↑ · 3 commentsCVE-2021-1905CVE-2018-9568

ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries

Zimperium documents ToxicPanda 2.0, an Android banking trojan now targeting 349 financial institutions in 16 countries via ADB privilege escalation and overlay credential theft.

Zimperium's zLabs documented ToxicPanda 2.0, an Android banking trojan expanding from 16 targeted apps to 349 financial institutions across 16 countries, with 167 remote commands. It poses as a dropper, abuses VPN permissions to block Google Play Protect while installing a hidden payload, then uses the Accessibility Service for screen monitoring and overlay-based credential theft. It automates enabling Android Wireless Debugging and completes the pairing handshake to gain ADB shell access for privilege escalation, and overlays fake lock screens to steal device PINs. Previously unfinished commands are now operational and samples are served from AWS-hosted storage buckets.

Security Affairs·Aug 22, 16:50 UTC · 25d agoMalware in the wild

Microsoft Teams for Android Vulnerability Exposes Sensitive Information

Microsoft patched CVE-2026-65812 in Teams for Android, an information-disclosure flaw that can leak credentials under specific conditions.

Microsoft fixed CVE-2026-65812, rated Important, which can insert sensitive information such as credentials into data sent by Microsoft Teams for Android (build 1416/1.0.0.2026133602). Exploitation is remote and low-complexity, requires low privileges plus user interaction, and impact is limited to high confidentiality impact. Microsoft says exploitation is less likely, with no public PoC, disclosure, or in-the-wild exploitation; the fix ships via the Teams app update on Google Play. Ofek Levin of Enclave reported the flaw through coordinated vulnerability disclosure.

Cyber Security News·Sep 9, 13:14 UTC · 7d agoVulnerabilityCVE-2026-658121

Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone

Citizen Lab confirms Pegasus zero-click iMessage spyware infected a Serbian student activist's iPhone amid at least 14 spyware targets in Serbia during 2026.

The Citizen Lab, with the SHARE Foundation, confirmed an iMessage zero-click exploit infected a Serbian student protest movement member's iPhone with NSO Group's Pegasus spyware, with high-confidence indicators from December 2025 to January 2026. The exploit was addressed by Apple in iOS 18.4.1, released April 2025. At least 14 people in Serbia, including students, activists, an MP, and a councilor, were targeted with advanced spyware since the start of 2026, coinciding with March 29, 2026 local elections; a new Android spyware similar to NoviSpy was also found on a confiscated device.

The Hacker News·Sep 3, 08:43 UTC · 13d agoThreat actor in the wild

Mantax OTAX Android Ransomware Spies on Users, Steals OTPs and Encrypts Files

New Android malware family Mantax OTAX combines ransomware, spyware, and OTP theft via sideloaded APKs, linked to Indonesian threat actors.

Researchers at zLabs and Zimperium analyzed Mantax OTAX, an aggressive Android malware strain distributed as sideloaded APKs through phishing and messaging lures on third-party file-sharing services. The malware requests device-administrator and Accessibility permissions to steal lock-screen PINs, intercept SMS one-time passwords, harvest contacts and history, capture screens via MediaProjection, and silently photograph victims, while encrypting files with AES and writing .enc files on Android 9 and older. Its C2 uses HTTPS at apimantax[.]otax[.]fun with the active domain fetched dynamically from a GitHub repository, and a newer version adds WebSocket communication, app blocking, video overlays, and text-to-speech harassment. A Firebase misconfiguration exposed extortion conversations and victim data, and Android 10+ Scoped Storage limits the encryption reach but not the surveillance capabilities.

GBHackers·updated Sep 11, 12:14 UTC · 5d ago·first Sep 11, 07:14 UTC · 5d agoMalware in the wild 6 sources1

Android Car Malware Spreads Through Built

Kaspersky found MoYu Group malware infecting DoFun Android car head units via firmware updaters, enabling ad fraud and proxy botnet operations.

Kaspersky discovered in June 2026 the first documented malware specifically infecting Android-based car head units, spread through the built-in updater (TWCore) of DoFun head unit firmware via a dropper dubbed JarService. The multi-stage implant supports nine commands enabling unwanted ads, ad fraud, and additional module downloads, and installs the zhima reverse proxy module. The campaign is attributed with high confidence to the MoYu Group behind the BADBOX ad fraud and residential proxy scheme; the distribution issue was fixed after responsible disclosure.

The Hacker News·Aug 25, 06:01 UTC · 22d agoMalware in the wild

Pegasus and NoviSpy Used Against Serbian Protesters

Citizen Lab confirmed zero-click Pegasus infected a Serbian student activist's iPhone, part of the largest documented Serbian spyware wave targeting at least 14 people.

The Citizen Lab, with the SHARE Foundation, confirmed a Serbian student protest movement member's iPhone was infected with NSO Group's Pegasus via an iMessage zero-click exploit between December 2025 and January 2026; Apple patched the exploit in iOS 18.4.1. SHARE Foundation has documented at least 14 targeted individuals since early 2026, including student activists, civil society figures, an opposition MP and a local councilor, coinciding with the March 2026 local elections. SHARE and Amnesty Tech also found a new NoviSpy variant on a student activist's Android phone after Serbian authorities seized it during police questioning.

Security Affairs·Sep 3, 20:17 UTC · 13d agoThreat actor in the wild