mobile security
-
Kimsuky campaign uses QR codes to deliver DocSwap Android malware, South Korean firm says
South Korean firm ENKI linked the North Korean actor Kimsuky to a campaign distributing a DocSwap Android trojan via QR codes on phishing sites impersonating CJ Logistics; the malware decrypts an embedded APK, registers a RAT service and accepts many remote commands.
-
GoldFactory modifies banking apps to spread Android remote-access trojans across Southeast Asia, Group-IB reports
Group-IB said GoldFactory has been distributing modified banking apps across Thailand, Vietnam and Indonesia to deploy Android remote-access trojans that abuse accessibility services, and researchers uncovered a pre-release variant called Gigaflower with advanced data-extraction features.
-
Google issues December Android security updates, patches 107 flaws including two exploited in the wild
Google released December 2025 Android security patches that fix 107 vulnerabilities across multiple components, including two Framework flaws reported as exploited in the wild; users and manufacturers are urged to apply the 2025-12-01 or 2025-12-05 updates.
-
CISA warns of active spyware campaigns targeting messaging app users
CISA warned that threat actors are actively using commercial spyware and remote access trojans to compromise users of mobile messaging apps, citing multiple campaigns that used techniques such as zero‑click exploits, device‑linking QR codes and spoofed apps, and urged high‑value individuals to follow specific security guidance.
-
North Korean-linked group used Google device service to wipe South Korean Android phones
South Korean researchers say the North Korean-linked KONNI group abused Google’s device-management features to remotely factory-reset Android phones, using stolen credentials harvested via phishing and RATs spread over KakaoTalk.
-
New Android banking trojan Klopatra has infected more than 3,000 devices, Cleafy says
Cleafy said a new Android banking trojan called Klopatra has infected over 3,000 devices, mainly in Spain and Italy, using VNC remote control, dynamic overlays and abuse of Android accessibility services to steal credentials and perform fraudulent transfers.
-
Samsung patches critical CVE-2025-21043 Android vulnerability exploited in the wild
Samsung has issued a September 2025 security update to patch CVE-2025-21043, a critical remote code execution flaw in a Quramsoft image parsing library used on Android devices, underscoring the need for immediate patching across affected devices.
-
RatOn Android malware evolves into ATS-enabled remote access trojan, ThreatFabric says
ThreatFabric reports that RatOn has evolved from NFC relay attacks into an ATS-enabled Android remote access trojan, capable of automated cryptocurrency transfers, overlay ransomware-style screens, and NFC relay via NFSkate, with initial activity centered in the Czech Republic and Slovakia likely to follow.
-
Major Mobile Ad Fraud Operation IconAds Discovered
The IconAds mobile ad fraud operation, involving 352 Android apps, has been disrupted, according to HUMAN. The malicious apps generated 1.2 billion daily bid requests, primarily targeting users in Brazil, Mexico, and the US, before their removal from the Play Store.
-
Apple Prevents Over $9 Billion in Fraudulent Transactions in Last Five Years
Apple Inc. has revealed that it prevented more than $9 billion in fraudulent transactions in the last five years, particularly noting over $2 billion in the year 2024 alone, through stringent App Store policies aimed at protecting users from deceptive apps and other malicious activities.
