Tag Android

Google Issues Android Security Patch to Address 3 Actively Exploited Vulnerabilities

Date: July 7, 2023

In its latest security update, Google has addressed 46 new vulnerabilities in the Android operating system, highlighting three that are actively exploited in targeted attacks. Notably, CVE-2023-26083 pertains to a memory leak issue in the Arm Mali GPU driver for Bifrost, Avalon, and Valhall architectures. This vulnerability was previously exploited in December 2022, allowing spyware to infiltrate Samsung devices. Its severity prompted the Cybersecurity and Infrastructure Security Agency (CISA) to issue a patching directive for federal agencies in April 2023. Additionally, CVE-2021-29256 represents a high-severity flaw affecting certain versions of the Bifrost and Midgard Arm Mali GPU kernel drivers, enabling an unprivileged user to access sensitive data and escalate privileges to the root level.

Google Addresses Critical Vulnerabilities in Latest Android Update On July 7, 2023, Google rolled out its monthly security updates for the Android operating system, patching a total of 46 newly identified vulnerabilities. Notably, three of these vulnerabilities have been confirmed as actively exploited in specific targeted attacks, raising concerns among…

Read More

Google Issues Android Security Patch to Address 3 Actively Exploited Vulnerabilities

Date: July 7, 2023

In its latest security update, Google has addressed 46 new vulnerabilities in the Android operating system, highlighting three that are actively exploited in targeted attacks. Notably, CVE-2023-26083 pertains to a memory leak issue in the Arm Mali GPU driver for Bifrost, Avalon, and Valhall architectures. This vulnerability was previously exploited in December 2022, allowing spyware to infiltrate Samsung devices. Its severity prompted the Cybersecurity and Infrastructure Security Agency (CISA) to issue a patching directive for federal agencies in April 2023. Additionally, CVE-2021-29256 represents a high-severity flaw affecting certain versions of the Bifrost and Midgard Arm Mali GPU kernel drivers, enabling an unprivileged user to access sensitive data and escalate privileges to the root level.

Kimsuky Hackers from North Korea Face Data Breach After Insider Leaks Information Online

A notable breach has emerged from North Korea’s Kimsuky espionage group, with insiders leaking hundreds of gigabytes of sensitive internal files and tools to the public. This incident, which surfaced in early June 2025, reveals critical backdoors, phishing mechanisms, and reconnaissance strategies employed by the state-sponsored threat actor—marking an unusual…

Read MoreKimsuky Hackers from North Korea Face Data Breach After Insider Leaks Information Online

Google Alerts Users to Actively Exploited CVE-2024-43093 Vulnerability in Android

November 5, 2024 – Mobile Security / Vulnerability

Google has issued a warning regarding a security vulnerability in its Android operating system that is currently being actively exploited. Identified as CVE-2024-43093, this privilege escalation flaw affects the Android Framework component and may allow unauthorized access to the “Android/data,” “Android/obb,” and “Android/sandbox” directories, along with their subdirectories. While details on the exploitation methods remain limited, Google noted in its monthly report that there are signs of “limited, targeted exploitation.” Additionally, the company highlighted CVE-2024-43047, a previously patched security issue in Qualcomm chipsets, which is also being actively exploited. This particular vulnerability involves a use-after-free flaw in the Digital Signal Processor (DSP) Service, where successful exploitation could lead to memory corruption.

Google Alerts Users to Actively Exploited CVE-2024-43093 Vulnerability in Android On November 5, 2024, Google issued a critical warning regarding a security vulnerability in the Android operating system, designated as CVE-2024-43093. This vulnerability involves privilege escalation within the Android Framework component, potentially allowing unauthorized access to sensitive directories, including “Android/data,”…

Read More

Google Alerts Users to Actively Exploited CVE-2024-43093 Vulnerability in Android

November 5, 2024 – Mobile Security / Vulnerability

Google has issued a warning regarding a security vulnerability in its Android operating system that is currently being actively exploited. Identified as CVE-2024-43093, this privilege escalation flaw affects the Android Framework component and may allow unauthorized access to the “Android/data,” “Android/obb,” and “Android/sandbox” directories, along with their subdirectories. While details on the exploitation methods remain limited, Google noted in its monthly report that there are signs of “limited, targeted exploitation.” Additionally, the company highlighted CVE-2024-43047, a previously patched security issue in Qualcomm chipsets, which is also being actively exploited. This particular vulnerability involves a use-after-free flaw in the Digital Signal Processor (DSP) Service, where successful exploitation could lead to memory corruption.

New Android Banking Malware ‘ToxicPanda’ Pilfers Funds Through Deceptive Transfers

Nov 05, 2024
Mobile Security / Cyber Attack

A newly discovered Android banking malware, dubbed ToxicPanda, has already compromised over 1,500 devices, enabling cybercriminals to execute fraudulent transactions. According to Cleafy researchers Michele Roviello, Alessandro Strino, and Federico Valentini, “ToxicPanda’s primary aim is to facilitate money transfers from infected devices through account takeover (ATO) techniques, leveraging a method known as on-device fraud (ODF).” The malware is designed to circumvent banking security measures that verify user identity and authenticate transactions, along with behavioral detection strategies used by banks to flag suspicious money transfers. It is believed that ToxicPanda is linked to a Chinese-speaking threat actor and bears notable similarities to another Android malware called TgToxic, which can steal user credentials and deplete crypto wallets. TgToxic was first reported by Trend Micro in early 2023.

New Android Banking Malware ‘ToxicPanda’ Exploits Devices for Fraudulent Transactions November 5, 2024 Mobile Security / Cyber Attack A newly discovered strain of Android banking malware, named ToxicPanda, has reportedly compromised over 1,500 Android devices, enabling cybercriminals to execute unauthorized banking transactions. According to researchers Michele Roviello, Alessandro Strino, and…

Read More

New Android Banking Malware ‘ToxicPanda’ Pilfers Funds Through Deceptive Transfers

Nov 05, 2024
Mobile Security / Cyber Attack

A newly discovered Android banking malware, dubbed ToxicPanda, has already compromised over 1,500 devices, enabling cybercriminals to execute fraudulent transactions. According to Cleafy researchers Michele Roviello, Alessandro Strino, and Federico Valentini, “ToxicPanda’s primary aim is to facilitate money transfers from infected devices through account takeover (ATO) techniques, leveraging a method known as on-device fraud (ODF).” The malware is designed to circumvent banking security measures that verify user identity and authenticate transactions, along with behavioral detection strategies used by banks to flag suspicious money transfers. It is believed that ToxicPanda is linked to a Chinese-speaking threat actor and bears notable similarities to another Android malware called TgToxic, which can steal user credentials and deplete crypto wallets. TgToxic was first reported by Trend Micro in early 2023.

⚡ Weekly Highlights: Scattered Spider Arrests, Car Hacks, macOS Malware, Fortinet RCE, and More

This week in cybersecurity has shed light on critical vulnerabilities and significant criminal activity affecting major organizations. Precision is paramount in this field; minor oversights can cascade into enormous security breaches. In this context, notable incidents underline systemic issues, such as reliance on outdated tools, sluggish risk responses, and a…

Read More⚡ Weekly Highlights: Scattered Spider Arrests, Car Hacks, macOS Malware, Fortinet RCE, and More

DoNot Team Linked to New Tanzeem Android Malware Aimed at Intelligence Gathering

The threat group known as DoNot Team is associated with a new Android malware linked to highly targeted cyber attacks. The malware, identified as Tanzeem (meaning “organization” in Urdu) and its update variant, was discovered by cybersecurity firm Cyfirma in October and December 2024. These applications share nearly identical functionalities, with only slight user interface changes. Cyfirma’s Friday analysis pointed out, “While designed as a chat application, it fails to operate after installation, crashing once the required permissions are granted.” The app’s name indicates a focus on targeting specific individuals or groups both domestically and internationally. DoNot Team, also known as APT-C-35, Origami Elephant, SECTOR02, and Viceroy Tiger, is a hacking group believed to originate from India, notorious for utilizing spear-phishing emails and various Android malware strains in their attacks.

DoNot Team Linked to Emerging Tanzeem Android Malware Targeting Intelligence Gathering January 20, 2025 In a notable development in the cyber threat landscape, the hacking group known as DoNot Team has been associated with a new strain of Android malware. This malware, identified as Tanzeem, which translates to “organization” in…

Read More

DoNot Team Linked to New Tanzeem Android Malware Aimed at Intelligence Gathering

The threat group known as DoNot Team is associated with a new Android malware linked to highly targeted cyber attacks. The malware, identified as Tanzeem (meaning “organization” in Urdu) and its update variant, was discovered by cybersecurity firm Cyfirma in October and December 2024. These applications share nearly identical functionalities, with only slight user interface changes. Cyfirma’s Friday analysis pointed out, “While designed as a chat application, it fails to operate after installation, crashing once the required permissions are granted.” The app’s name indicates a focus on targeting specific individuals or groups both domestically and internationally. DoNot Team, also known as APT-C-35, Origami Elephant, SECTOR02, and Viceroy Tiger, is a hacking group believed to originate from India, notorious for utilizing spear-phishing emails and various Android malware strains in their attacks.

Unless Users Act, Android Will Allow Gemini to Access Third-Party Apps

Google’s Gemini AI Update Raises Privacy Concerns Beginning today, Google has initiated a significant change that allows its Gemini AI engine to interact with third-party applications, including popular services like WhatsApp, regardless of prior user settings designed to restrict such interactions. Users who wish to maintain their initial privacy settings…

Read MoreUnless Users Act, Android Will Allow Gemini to Access Third-Party Apps

New Expert Insights Uncover Greater Issues Following Qantas Cyber Attack

The recent cyber attack on Qantas has sent shockwaves through the security community, highlighting the evolving methods employed by decentralized global hacking groups. Expert analysis has shed light on the agile and organized tactics that characterize these groups, prompting deeper scrutiny into the vulnerabilities that major corporations and their third-party…

Read MoreNew Expert Insights Uncover Greater Issues Following Qantas Cyber Attack

Millions of Affordable Android Devices Transform Home Networks into Crime Hubs

FBI Warns of Widespread Malware Infection in Low-Cost Media Devices Millions of affordable devices catering to media streaming, automotive entertainment, and video projection are reportedly compromised by malware, transforming consumer networks into conduits for distributing malicious software, obscuring unauthorized communications, and executing various illicit operations. This alarming report has been…

Read MoreMillions of Affordable Android Devices Transform Home Networks into Crime Hubs