SOVA, a new Android Banking Trojan, is spreading across Europe. Already appeared in different versions, this malware is now evolving, and it is targeting more than 200 mobile applications, ranging from banking apps to crypto exchanges/wallets. Here's the…

Following our presentation at Black Hat USA, in this blog post we provide some details on CVE-2022-20233, the latest vulnerability we found on Titan M, and how we exploited it to obtain code execution on the chip.

In Q2 2022, we detected 405,684 mobile malware installation packages, of which 55,614 packages were related to mobile banking trojans, and 3,821 packages were mobile ransomware trojans.

So far we went trough the most important instructions of the AArch64 instruction set and it is time to move to something more practical. In…

During a Digital Forensics investigation, ZecOps made an interesting finding: a cheap burner device that purported to be an Android 10 was actually an old Android 6. In the first part of the series, we presented how attackers can ‘fake’ the shutdown screen…

Analysis of the group behind Xenomorph and Gymdrop

Researchers at Checkmarx found that the Ring Android app could have allowed a malicious application installed on the user’s phone to expose their personal data, geolocation, and camera recordings.

Note: all applications mentioned in this research have been taken down and are
no longer accessible.

This post explains how to bypass TLS verification on Flutter apps, including bypassing Dio Pinning.

Technical analysis of the MoqHao (a.k.a RoamingMantis) Android malware and phishing campaign

A collection of interesting and diverse Android malware samples

Doctor Web reports that it has discovered backdoors in the system partition of budget Android device models that are counterfeit versions of famous brand-name models. These trojans target arbitrary code execution in the WhatsApp and WhatsApp Business messaging…

'apk-yara-checker' is a little CLI tool written in Rust to check Yara rules against a folder of APK files. - segura2010/apk-yara-checker

Kernel exploitation technique. Contribute to Markakd/DirtyCred development by creating an account on GitHub.

We will discuss the chaining of two bugs on the telegram android application, which can make malicious applications steal internal telegram…

In the first part, we are going to examine the top 10 basic security factors in 18 Iranian banking apps to see how strong their walls are

A PDF reader found on Google Play with over one million downloads is aggressively displaying full screen ads, even when the...

In this video, we unpack a malicious sample of Android/Joker with an open source tool named Medusa. This tool is dynamic, based on Frida. We select hooks to display unobfuscated strings, dump dynamic DEX and URLs.

A similar demo was presented in French at…