Useful tutorial on how to port Kali NetHunter (including custom Kernel) to unsupported "Essential Phone"
https://odysee.com/@z2rec:1/how-i-ported-kali-nethunter-to-unsupported-device:c

From ERMAC to Hook: Investigating the technical differences between two Android malware variants
https://research.nccgroup.com/2023/09/11/from-ermac-to-hook-investigating-the-technical-differences-between-two-android-malware-variants/

Android App Pin Security Issue Allows Unauthorized Payments via Google Wallet even with enabled "Require device unlock for NFC" option (CVE-2023-35671)
While in pinned mode, all other apps become temporarily inaccessible, except Google Wallet.
PoC: https://github.com/MrTiz/CVE-2023-35671

Android trojan masquerade as an Iranian online trading platform
https://news.drweb.com/show/?i=14748&lng=en

Massive Mobile Security Framework (MMSF)
A mobile open-source framework that combines functionalities from frida, objection, drozer, reflutter and more for iOS and Android app analysis
Info: https://securitycafe.ro/2023/09/18/mobile-pentesting-101-introducing-to-mmsf-massive-mobile-security-framework/
Download: https://github.com/St3v3nsS/MMSF

Brute forcing Android app's PIN using Frida to bypass bank's 2FA and get authorization token
https://www.corellium.com/blog/frida-brute-forcing-pins-mobile-pentest

In December 2022, Google discovered in-the-wild exploit chain targeting Samsung Android devices used by commercial mobile spyware vendor Variston.
It appears that n-day exploits that were fixed in Google products in 2022 (Chrome), were not fixed yet in Samsung (Samsung browser) and because of that exploited by espionage software in early exploitation stages.
Final stage, describes how attacker achieved execution as system_server (CVE-2023-0266, CVE-2023-26083)
https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-android-exploit.html

Transparent Tribe’s (APT36) Android CapraRAT Mimics YouTube to Hijack Android Phones
https://www.sentinelone.com/labs/capratube-transparent-tribes-caprarat-mimics-youtube-to-hijack-android-phones/

How to bypass 5 advanced root detection techniques using Frida
https://8ksec.io/advanced-root-detection-bypass-techniques/

"The WebP 0day" - a full technical analysis the recently patched vulnerability in the WebP image library that was exploited in the wild (CVE-2023-4863)
https://blog.isosceles.com/the-webp-0day/

0-days exploited by Predator spyware were delivered via man-in-the-middle (MITM) attack and 0-click vulnerability against iOS and Android
https://blog.google/threat-analysis-group/0-days-exploited-by-commercial-surveillance-vendor-in-egypt/

Working solution on how to inject system CA certificates in Android 14
https://httptoolkit.com/blog/android-14-install-system-ca-certificate/

Android Xenomorph Malware Strikes Again: Over 30+ US Banks Now Targeted
https://www.threatfabric.com/blogs/xenomorph

EvilBamboo Targets Mobile Devices in Multi-year Campaign
https://www.volexity.com/blog/2023/09/22/evilbamboo-targets-mobile-devices-in-multi-year-campaign/

NVIDIA GeForce Now for Android contains a vulnerability where a malicious application on the same device can process the implicit intent meant for the streamer component. A successful exploit of this vulnerability may lead to limited information disclosure, denial of service, and code execution (CVE‑2023‑31014)
https://nvidia.custhelp.com/app/answers/detail/a_id/5476

How it is possible to get persistent reverse shell from Android app without visible permissions to make device unusable via annoying DoS
https://www.mobile-hacker.com/2023/09/27/get-persistent-reverse-shell-from-android-app-without-visible-permissions-to-make-device-unusable/

iOS 15 Image Forensics Analysis and Tools Comparison - Processing details and general device information
https://blog.digital-forensics.it/2023/09/ios-15-image-forensics-analysis-and.html

Use silent SMS messages to track LTE users’ locations
https://mandomat.github.io/2023-09-21-localization-with-silent-SMS/

Android banking trojan Zanubis, first appeared around August 2022, targeting financial institution and cryptocurrency exchange users in Peru
Zanubis’s main infection path is through impersonating legitimate Peruvian Android applications and then tricking the user into enabling the Accessibility permissions in order to take full control of the device
https://securelist.com/crimeware-report-asmcrypt-loader-lumma-stealer-zanubis-banker/110512/

Analysis of LightSpy mAPT Mobile Payment System Attack attributed to APT-41 group
https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack

BADBOX: a firmware backdoored trojan found in 74,000 Chinese Android phones, tablets, and TV boxes in 227 counties and territories
There are confirmed 8 devices with backdoors installed — seven TV boxes, the T95, T95Z, T95MAX, X88, Q9, X12PLUS, and MXQ Pro 5G, and a tablet J5-W.
BADBOX functionality:
-Ad Fraud,
-Uses backdoored devices as proxy,
-Create fake accounts,
-Downloads and runs additional modules.
Report: https://www.humansecurity.com/hubfs/HUMAN_Report_BADBOX-and-PEACHPIT.pdf