Explicit intents have a set receiver (the name of an app package and the class name of a handler component) and can be delivered only to a predetermined component (activity, receiver, service). With implicit intents, only certain

Contribute to androidmalware/android_frida_noscripts development by creating an account on GitHub.

Link previews in chat apps can cause serious privacy problems if not done properly. We found several cases of apps with vulnerabilities such as: leaking IP addresses, exposing links sent in end-to-end encrypted chats, and unnecessarily downloading gigabytes…

Avast has uncovered another set of malicious apps in the Google Play Store. While adware is hidden by design, there are steps each person can take to protect themselves and their families.

By Warren Mercer, Paul Rascagneres and Vitor Ventura.

* The newly discovered Firestarter malware uses Google Firebase Cloud Messaging to notify its authors of the final payload location.
* Even if the command and control (C2) is taken down, the DoNot team…

Given Android app is called Keybox. it is a container for the flag and all the hints to it. The flag is encrypted

Posted by Haining Chen, Vishwath Mohan, Kevin Chyn and Liz Louis, Android Security Team [Cross-posted from the Android Developers Blog ] ...

iOS SSL Pinning Bypass (iOS 8 - 14). Contribute to evilpenguin/SSLBypass development by creating an account on GitHub.

Patches those pesky APKs for proxy use. Contribute to evilpenguin/APKProxyHelper development by creating an account on GitHub.

Through dynamic loading malware authors can covertly load malicious code into their application in order to avoid detection. We can detect such loading...

Guildma's new creation, the Ghimob banking trojan, has been a move toward infecting mobile devices, targeting financial apps from banks, fintechs, exchanges and cryptocurrencies.

We recently detected a new version of the Joker mobile malware on a sample on Google Play. This update utilizes Github pages and repositories in an attempt to evade detection.

Sniff XPC goodies on your iOS device. Contribute to evilpenguin/XPCSniffer development by creating an account on GitHub.

Upstream’s mobile security platform Secure-D identified that a popular Android app was responsible for over 20 million fraudulent transaction attempts.

Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. This provides an interface to assess your android application security hacking skills. - rewanthtammana/Damn-...

CVE-2020-15647 PoC. GitHub Gist: instantly share code, notes, and snippets.