ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “mobile-security”

22 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPhishing & fraud 2Exploit / PoC 1
SeverityAllcritical 3high 0medium 0low 0info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Top 10 Best Mobile Threat Defense (MTD) Solutions in 2026

Roundup of 2026 mobile threat defense tools recommends Zimperium and Lookout for targeted-attack detection and Defender for Endpoint for Microsoft shops.

This guide ranks ten mobile threat defense solutions, recommending Zimperium and Lookout for on-device detection against targeted users such as executives and journalists, and Microsoft Defender for Endpoint mobile for organizations already licensing Microsoft 365 E5. It explains that MDM enforces configuration while MTD detects attacks, and that mobile phishing now arrives via SMS, messaging apps and QR codes rather than email. It also highlights mercenary spyware and zero-click exploits as shifting requirements for high-risk users, referencing Apple's threat-notification program and Lockdown Mode.

Cyber Security News · 7d agoIndustry

Android security advisory – September 2026 monthly rollup (AV26-920)

Canadian Cyber Centre relays Android's September 2026 security bulletin, urging users and administrators to apply device updates.

The Canadian Centre for Cyber Security issued advisory AV26-920 pointing to the Android security bulletin published September 8, 2026. Users and administrators are encouraged to review the linked bulletin and apply necessary updates as they become available. The alert itself lists no specific CVEs, affected components, or exploitation details.

Canadian Centre for Cyber Security · 1d agoAdvisory

Samsung mobile security advisory (AV26-919)

Canadian Cyber Centre relays Samsung's September 2026 mobile security update (SMR-SEP-2026) fixing multiple vulnerabilities; users urged to apply patches.

The Canadian Centre for Cyber Security issued advisory AV26-919 on September 14, 2026, relaying Samsung's September 8, 2026 security update for Samsung mobile devices. The update covers versions prior to SMR-SEP-2026 and resolves multiple identified vulnerabilities. Users and administrators are encouraged to review the Samsung bulletin and apply the necessary update.

Canadian Centre for Cyber Security · 1d agoAdvisory

Product showcase: mSecure makes one vault do more than remember passwords

Product showcase reviews mSecure password manager's AES-256 zero-knowledge vault with passkeys, 2FA storage, and multi-device sync options.

mSecure is a password manager and data vault for iOS, Android, macOS, and Windows using AES-256 encryption and a zero-knowledge architecture, with sync via mSecure Cloud, Wi-Fi, iCloud, or Dropbox, plus local-only storage. It supports passkeys, one-time passwords, a Security Center for weak/reused passwords, and a configurable password generator. Recovery features include two-factor authentication, auto-lock, a Self-Destruct option after failed unlock attempts, and iCloud backups on iOS.

Help Net Security · 1d agoTools1

A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices

Researchers showed malicious SIM cards can issue RUN AT commands to execute code on Qualcomm modems, compromising Quectel-based cellular IoT devices like EV chargers.

Researchers at the University of Birmingham and Fuzzware found 9 of 26 tested devices accept SIM proactive commands, including six Qualcomm-based cellular modules, five of them Quectel. They achieved code execution on a commercial Autel EV charger via the Quectel EC25's atfwd_daemon unsafe format string, and demonstrated an irreversible 2G downgrade, modem power-off, and arbitrary file reads via a root TFTP daemon on a Quectel EG25-G. Attacks require a hostile SIM already in the slot or an interposer; no attacks have been reported in the wild. Qualcomm has built a hardened configuration disabling the interface by default and Quectel mitigated the file-access flaw; the paper was presented at USENIX WOOT.

The Hacker News · Aug 11, 2026VulnerabilityCVE-2025-48618

Can We Stop The Ads? Taxonomy and Characterization of Smartphone Splash Ads and Existing Countermeasures

Study of 108 ad-defense implementations finds only one tool blocked splash-ad navigation across ten popular apps, and it required Accessibility permission.

The paper taxonomizes smartphone splash ads — full-screen ads at app launch that trick users into trigger mechanisms such as moving the phone — and analyzes 108 documented advertising defenses for deployment barriers. Many defenses require device rooting, jailbreaking, runtime code injection, or application modification; others need extra permissions, rule maintenance, compilation, or payment. In evaluating 13 configurations of 11 tools across 10 popular apps, only one prevented ad-triggered navigation across all ten apps, requiring Accessibility permission and leaving ads visible roughly one second before dismissal. Documented harms include delayed emergency response, driver distraction, and degraded accessibility for vision-impaired users.

arXiv cs.CR · 18h agoResearch

RightCrowd Pass unifies mobile, physical, and biometric credentials

RightCrowd launched Pass, a credentialing platform unifying mobile, physical, and biometric access credentials, cutting credential revocation from 12.2 minutes to under 60 seconds.

RightCrowd announced Pass, a solution that issues and manages mobile, physical, and biometric access credentials from a single platform instead of fragmented badge programs. Mobile credentials are provisioned through a web-based API and can be suspended or revoked individually or in groups in under 60 seconds, versus an average 12.2 minutes for handling a lost or damaged physical badge. Each mobile credential is tied to a device via two-factor authentication, works with HID, Wavelynx, and LEGIC infrastructure, and counts toward LEED and BREEAM sustainability credits. The product is available now to new and existing customers and can be added to current RightCrowd SmartAccess deployments.

Help Net Security · 21d agoTools

CrossLink: Breaking Location Privacy by Linking Device Identifiers Across Protocols

Researchers present CrossLink, a passive tracing algorithm linking temporary device identifiers across LTE, WiFi, and BLE, reconstructing full traces for 83% of simulated users.

Smartphones emit temporary identifiers simultaneously over LTE, WiFi, and BLE, and per-protocol randomization defenses implicitly assume their protections compose across protocols. CrossLink is an uncertainty-aware tracing algorithm that stitches device identifiers across time, space, and protocols even when the adversary is fully passive and rotations are unsynchronized. In large-scale mobility simulation it reconstructs full traces for 83% of users versus 22% for the best single-protocol baseline. It remains effective under partial sniffer coverage, including strategically placed sniffers near LTE handover regions, mobile sniffers, and limited high-coverage subregions.

arXiv cs.CR · 7d agoResearch

Understanding the Security Boundary of Obfuscation-based On-Device LLM Protection

Researchers formalize obfuscation primitives for TEE-protected on-device LLMs and show a Collapse attack breaks ArrowCloak, TSQP, and LoRO, then extend the boundary.

The paper formalizes obfuscation primitives for TEE-Shielded LLM Partition (TSLP) schemes that offload computationally intensive layers from a Trusted Execution Environment to external GPUs. A novel primitive-guided attack, Collapse, demonstrates a shared vulnerability in prominent published methods including ArrowCloak (Security'25), TSQP (S&P'25), and LoRO (NeurIPS'25). The authors then introduce two new obfuscation primitives and integrate them with existing constructs to formulate an extended security boundary (O_ext).

arXiv cs.CR · 6d agoAI safety & security

Don't Trust the Super-App: A Case Study of Russia's Max

Researchers show super-apps like Russia's Max can silently capture mini-app UI, storage, network traffic, and authentication, enabling untraceable user impersonation.

The paper challenges the assumption that super-apps are trusted intermediaries, citing WeChat's passive cross-mini-app tracking, Russia's Max's entanglement with state prosecution of online speech, and Iran's Bale operating during a prolonged internet shutdown. Using Max as a case study, the authors demonstrate that a super-app can capture mini-app UI, read and write mini-app local storage, inject arbitrary JavaScript into mini-app runtimes, mediate network traffic, and control authentication context, enabling silent user impersonation without trace. They argue these capabilities are inherent to the super-app architecture and call for mobile OS and app store interventions to close the blind spot.

arXiv cs.CR · 5d agoResearch1

Getting a stranger’s phone kicked off the cellular network costs a few dollars

Researchers show attackers can remotely block strangers' phones and alarm gateways on US cellular networks by abusing lost/stolen IMEI reporting for $2.50-$4 per device.

Researchers from Michigan State University and three partner schools found six weaknesses in the lost/stolen device reporting ecosystem spanning devices, carrier systems, and cross-carrier block-list sharing. They demonstrated blocking unopened Samsung Galaxy Z Fold 7 phones and home alarm gateways on three major US carriers, with each block costing $2.50-$4 and taking roughly 20-80 seconds. The attacks exploit thin identity and ownership checks in prepaid accounts, IMEI leakage from vulnerable cellular chipsets used by two vendors with over 40% global market share, and pre-release IMEI databases purchasable for $600. Victims receive no notification, and restoring service requires proving device ownership to the carrier.

Help Net Security · 5d agoResearch

11 Best Device Control & USB Security Tools Compared (2026): Features & Pricing

2026 comparison of 11 device control and USB security tools ranks CoSoSys Endpoint Protector first for cross-platform control and DLP.

An editorial scorecard evaluates eleven device control and removable-media security tools across granularity, content-aware DLP, cross-platform parity, encryption/shadowing, and value. CoSoSys Endpoint Protector (now part of Netwrix) leads at 4.60 for genuine Windows, macOS, and Linux parity, with Ivanti DeviceLock at 4.25 for the deepest Windows peripheral control and Safetica positioned for SMB and mid-market value. Enterprise content-aware DLP anchors include Symantec (Broadcom), Forcepoint, Digital Guardian (Fortra), and Trellix, with pricing almost always per endpoint.

GBHackersupdated · 18m agofirst · 5d agoIndustry 12 sources

Android 17 adds new protections against sneaky Wi-Fi tracking and web snooping

Android 17 adds Encrypted Client Hello, Local Network Protection, default Certificate Transparency and operator-controlled 2G disabling to counter Wi-Fi tracking and snooping.

Google announced network security changes in Android 17, led by broad support for Encrypted Client Hello (ECH), which encrypts domain names visible to network operators and eavesdroppers, paired with GREASE decoys where server support is uneven. Jigsaw testing across the top 10,000 domains and 740 ISPs in 202 countries found connection success and interference levels comparable to ordinary TLS. Android 17 also adds Local Network Protection requiring app permission to scan local devices, Certificate Transparency on by default to catch forged certificates, and operator-side 2G disabling to cut exposure to SMS blaster fake base stations. Apps targeting Android 17 get ECH by default via networking libraries such as OkHttp, WebView and HttpEngine.

Help Net Security · 19d agoTools

CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls

Researchers introduce CONTINUITY, a framework of assume-guarantee contracts that preserves LLM agent security context across components, verified across 2,560 attack instances.

The paper identifies security-context discontinuity, where individually sound controls drop, widen, or reinterpret security context as actions cross component boundaries, and proposes CONTINUITY, a framework of assume-guarantee contracts using signed root grants, provenance commitments, role-bound transition receipts, and effect-bound execution permits. It formalizes end-to-end consequence integrity, requiring every external effect to be backed by a valid authorization witness linking principal, task, provenance, and policy state. A reference verifier and cross-layer fault-injection suite covering 32 fault classes showed the full configuration committed no harmful external effect across 2,560 parameterized attack instances while completing all 700 benign tasks and escalating all 200 ambiguous cases.

arXiv cs.CR · 11d agoAI safety & security

Chrome adopts what may be the best protection yet against account takeovers

Chrome adopts device-bound session credentials that tie login sessions to a specific device, defending against cookie-theft account takeover attacks.

Chrome is adopting device-bound session credentials, which bind authenticated sessions to the physical device rather than to transferable cookies. The mechanism targets a common account takeover technique in which attackers steal session cookies and replay them on other machines. Ars Technica characterizes it as possibly the strongest protection yet against this class of takeover, which has become increasingly common.

Ars Technica · Security · Aug 11, 2026Tools

Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives

Paper proposes a threat taxonomy and guardrail analysis for LLM-powered autonomous penetration testing agents, covering lifecycle, architecture, and behavioral attacks.

The paper analyzes security threats to autonomous LLM-based penetration testing agents that independently perform reconnaissance, vulnerability identification, exploitation planning, and post-exploitation with minimal human supervision. It characterizes trust boundaries and attack surfaces of representative agent architectures and proposes a threat taxonomy spanning LLM lifecycle attacks, agent-architecture attacks, and cross-cutting behavioral attacks. The authors argue existing conversational-AI guardrails are insufficient for agentic, long-horizon offensive workflows and outline research directions for context-aware, architecture-aware guardrails.

arXiv cs.CR · 1d agoAI safety & security

Automobile Camouflage to Hide from Flock Cameras

Schneier on Security highlights a printed vehicle-camouflage pattern tested to defeat Flock surveillance cameras and Axon body cameras.

The post discusses covering cars with printed patterns designed to fool Flock automated license-plate recognition software, with testing reportedly done against Flock and Axon body cameras. Reader comments question effectiveness against other ALPR vendors, Flock's RF MAC-address upgrade, and whether such camouflage might become regulated. The page also contains off-topic comment threads about anti-bot over-blocking and privacy.

Schneier on Security · 8d agoResearch