Microsoft discovered a high-severity vulnerability in the TikTok Android application, now identified as CVE-2022-28799 and fixed by TikTok, which could have allowed attackers to compromise users' accounts with a single click.

بسم الله الرحمن الرحيم

Over three-quarters of the apps Symantec analyzed contained valid AWS access tokens that allowed access to private AWS cloud services.

Authored by Alberto Segura (main author) and Mike Stokkel (co-author) Introduction After we discovered in February 2022 the SharkBotDropper in Google Play posing as a fake Android antivirus and cle…

بسم الله الرحمن الرحيم

Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw2w-gpcv-v39f

In this post I describe a somewhat unique Android kernel exploit, which utilizes the TrustZone in order to compromise the kernel.

New Trojans on Google Play that secretly subscribe users to paid services - we called this family Harly. Similar to Joker and dates back to 2020, the current campaign is targeting users in Thailand.
https://t.co/fSKyY62FKD
https://t.co/mHfFJ6aavy

Authored by SangRyol Ryu and Yukihiro Okutomi  McAfee’s Mobile Research team recently analyzed new malware targeting mobile payment users in Japan. The

“What can you do with deep links?” I welcome you to the first installment of the deep links crash course series…

In this post, we will take a closer look at different types of deep links.

Short videos on reverse engineering mobile operating systems, applications, and firmware. Only real-world examples with free tools :)

بسم الله الرحمن الرحيم

Note: As of 2022/10/25 the information in this series is slightly outdated. See Part 5 for more up to date information.
The Car Last summer I bought a 2021 Hyundai Ioniq SEL. It is a nice fuel-efficient hybrid with a decent amount of features like wireless…

A fake mobile banking rewards app delivered through a link in an SMS campaign has been making the rounds, targeting customers of Indian banking institutions. Users who install the mobile app are unknowingly installing an Android malware with remote access…

بسم الله الرحمن الرحيم

This second blog post deals with native code obfuscation and RASP syscall interception

It was identified that the android **com.basecamp.bc3 application**, contains a Webview where the loaded URLs are not sanitised properly. As this webview's functionality is extended via javanoscript...