Many people believe that smartphones are somehow less of a target for threat actors.

WhatsApp zero-day vulnerability CVE-2025-55177 is currently under active exploitation, with a critical advisory issued as attackers target iOS and Mac devices.

Cyble Research and Intelligence Labs (CRIL) has uncovered “SikkahBot”, a new Android malware campaign targeting students in Bangladesh since July 2024.

In the ever-evolving landscape of mobile application security, SSL pinning has become a crucial defense mechanism against man-in-the-middle…

In our latest research we describe how droppers on Android are the silent malware gate keepers.

Comprehensive vulnerability database for your open source projects and dependencies.

On August 20th, Apple released an out-of-band security fix for its main operating systems. This patch allegedly fixes CVE-2025-43300, an out-of-bounds write, addressed with improved bounds checking in the ImageIO framework. In this blog post we provide a…

Covering the pros and cons of emulators versus real devices, and how to configure Magisk, Burp, Frida, Medusa and other mobile hacking tools.

CoRCTF 2025 - CoRPhone: Android Kernel Pwn. Contribute to 0xdevil/corphone development by creating an account on GitHub.

An in-depth exploration of the Linux POSIX CPU Timer Subsystem, including patch analysis and vulnerability insights for Android Kernel CVE-2025-38352.

This new research by ThreatFabric exposes RatOn, a new banking trojan with powerful capabilities.

I’ve got my hands on an internet-connected camera and decided to take a closer look, having already read about security issues with similar cameras. What I found far exceeded my expectations: fake access controls, bogus protocol encryption, completely unprotected…

Android users beware! A new Antidot campaign (banking trojan) named PhantomCall is targeting users of major financial institutions across Europe. Trusteer Labs shares what they’ve learned.

In my work analyzing native code in Android applications, I often try different techniques. Some work, others not so much. I’ve realized I…

Researchers: Louisa Abel, Lindsay Kaye, João Marques, Vikas Parthasarathy, João Santos, Adam Sell IVT Taxonomy: Misleading User Interface HUMAN’s Satori

If improperly secured, exported components become easy entry points for attackers to execute arbitrary code, access sensitive data, or manipulate the app’s behavior.