Cybersecurity articles tagged #Android on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/toxicpanda-2-0-android-malware-abuses-wireless-adb-and-vpnhttps://runtimerebel.com/blog/toxicpanda-2-0-android-malware-abuses-wireless-adb-and-vpnToxicPanda 2.0 Android malware uses VPN permissions to block Google Play and abuses Wireless ADB to gain shell access and deploy overlays.Sun, 23 Aug 2026 16:15:53 GMTToxicPandaAndroidMalwarePhishingCredential Thefthttps://runtimerebel.com/blog/android-car-head-unit-malware-spreads-via-built-in-updatershttps://runtimerebel.com/blog/android-car-head-unit-malware-spreads-via-built-in-updatersKaspersky discovered a new malware family targeting Android car head units via DoFun firmware updaters to build an ad fraud and proxy botnet.Sat, 22 Aug 2026 16:13:11 GMTMalwareAndroidAd FraudBotnethttps://runtimerebel.com/blog/unisoc-modem-exploit-chain-android-takeover-via-video-callhttps://runtimerebel.com/blog/unisoc-modem-exploit-chain-android-takeover-via-video-callAn exploit chain targeting Unisoc modems allows remote Android device takeover through a malicious video call, requiring victim interaction.Tue, 18 Aug 2026 00:41:53 GMTAndroidMobile SecurityRemote Code ExecutionExploit ChainUnisochttps://runtimerebel.com/blog/kimwolf-v7-botnet-evolves-with-advanced-ddos-and-c2-resiliencehttps://runtimerebel.com/blog/kimwolf-v7-botnet-evolves-with-advanced-ddos-and-c2-resilienceKimwolf v7, an Android/IoT botnet, enhances DDoS capabilities with HTTP/2 fingerprinting and robust, multi-layered C2 infrastructure.Tue, 11 Aug 2026 16:52:19 GMTKimwolfBotnetAndroidDDoSIoThttps://runtimerebel.com/blog/pixel-9-zero-click-rce-exploiting-dolby-unified-decoderhttps://runtimerebel.com/blog/pixel-9-zero-click-rce-exploiting-dolby-unified-decoderProject Zero details a zero-click exploit chain targeting Google Pixel 9 via the Dolby Unified Decoder, leading to arbitrary code execution.Sat, 08 Aug 2026 08:35:48 GMTGoogle PixelCVE-2025-54957Zero-DayRemote Code ExecutionAndroidhttps://runtimerebel.com/blog/project-zero-uncovers-android-0-click-exploit-chain-ecosystem-weaknesseshttps://runtimerebel.com/blog/project-zero-uncovers-android-0-click-exploit-chain-ecosystem-weaknessesProject Zero details findings from a Pixel 9 0-click exploit chain, highlighting critical Android ecosystem issues and proposing security enhancements.Sat, 08 Aug 2026 01:01:55 GMTAndroidDriver SecurityPixel 9Project ZeroCVE-2025-54957https://runtimerebel.com/blog/fake-bahrain-alert-apps-deploy-android-surveillance-malwarehttps://runtimerebel.com/blog/fake-bahrain-alert-apps-deploy-android-surveillance-malwareAnalyzing fake Bahrain alert apps distributing four-stage Android surveillance malware via phony app stores, exploiting geopolitical tensions for extensive data…Wed, 22 Jul 2026 21:12:30 GMTAndroidMobile SecuritySpywareSurveillance MalwareFake AppsPhishingSocial EngineeringBahrainhttps://runtimerebel.com/blog/redwing-maas-android-bank-fraud-via-telegram-rental-service-analysishttps://runtimerebel.com/blog/redwing-maas-android-bank-fraud-via-telegram-rental-service-analysisRedWing MaaS is an Android bank fraud malware-as-a-service rented on Telegram, enabling low-skill attackers to steal banking logins and OTPs.Tue, 07 Jul 2026 18:01:20 GMTRedWingMaaSAndroidBanking MalwareOblivionTelegramMobile Securityhttps://runtimerebel.com/blog/cve-2026-46242-linux-kernel-bad-epoll-flaw-grants-root-on-servers-androidhttps://runtimerebel.com/blog/cve-2026-46242-linux-kernel-bad-epoll-flaw-grants-root-on-servers-androidCritical Linux kernel 'Bad Epoll' flaw (CVE-2026-46242) allows unprivileged users to gain root access on servers, desktops, and Android devices. Patch now.Fri, 03 Jul 2026 21:09:03 GMTCVE-2026-46242Linux KernelPrivilege EscalationAndroidBad EpollLocal Roothttps://runtimerebel.com/blog/google-s-eur4-1b-eu-fine-stands-android-antitrust-implicationshttps://runtimerebel.com/blog/google-s-eur4-1b-eu-fine-stands-android-antitrust-implicationsGoogle loses final appeal against its €4.1 billion EU antitrust fine concerning Android's dominance. Understand the compliance implications for tech giants.Thu, 02 Jul 2026 17:54:31 GMTGoogleAndroidEUAntitrustComplianceRegulatoryCJEUCompetition Lawhttps://runtimerebel.com/blog/airdrop-and-quick-share-proximity-flaws-cause-crashes-and-bypass-checkshttps://runtimerebel.com/blog/airdrop-and-quick-share-proximity-flaws-cause-crashes-and-bypass-checksResearchers found six security flaws in AirDrop and Quick Share, enabling nearby attackers to crash devices and bypass security checks without user interaction.Tue, 30 Jun 2026 12:49:12 GMTAirDropQuick SharemacOSiOSAndroidWireless SecurityProximity AttackDenial of ServicePrivacy Bypasshttps://runtimerebel.com/blog/google-android-scam-detection-real-time-ai-defense-against-fraudhttps://runtimerebel.com/blog/google-android-scam-detection-real-time-ai-defense-against-fraudGoogle introduces AI-powered Scam Detection for Android, utilizing on-device Gemini Nano to identify fraud patterns and protect users from voice-based phishing.Wed, 03 Jun 2026 09:44:39 GMTAndroidGoogle Gemini NanoAI DeepfakesVishingMobile Securityhttps://runtimerebel.com/blog/android-june-2024-update-cve-2024-32896-zero-day-exploit-patchedhttps://runtimerebel.com/blog/android-june-2024-update-cve-2024-32896-zero-day-exploit-patchedGoogle fixes 124 vulnerabilities including an actively exploited Pixel firmware zero-day and critical RCE flaws in the June 2024 Android security update.Tue, 02 Jun 2026 13:27:26 GMTAndroidCVE-2024-32896PixelGoogleZero-DayPrivilege Escalationhttps://runtimerebel.com/blog/trapdoor-android-ad-fraud-455-apps-generate-659m-daily-bid-requestshttps://runtimerebel.com/blog/trapdoor-android-ad-fraud-455-apps-generate-659m-daily-bid-requestsResearchers reveal the Trapdoor ad fraud scheme, involving 455 Android apps and 183 C2 domains generating over 600 million daily fraudulent bid requests.Tue, 19 May 2026 20:39:59 GMTAndroidAd FraudTrapdoorHUMAN SatoriMalvertisinghttps://runtimerebel.com/blog/pixel-10-0-click-exploit-chain-re-targeting-cve-2025-54957-for-roothttps://runtimerebel.com/blog/pixel-10-0-click-exploit-chain-re-targeting-cve-2025-54957-for-rootAnalysis of a zero-click exploit chain targeting the Google Pixel 10, achieving root via an adapted Dolby vulnerability (CVE-2025-54957). Critical threat. Patch now.Wed, 13 May 2026 20:40:26 GMTPixel 10AndroidZero ClickCVE-2025-54957Exploit ChainRET PACRoot Exploithttps://runtimerebel.com/blog/android-cve-2026-0073-critical-system-rce-patch-guidancehttps://runtimerebel.com/blog/android-cve-2026-0073-critical-system-rce-patch-guidanceGoogle addresses a critical zero-click RCE vulnerability (CVE-2026-0073) in the Android System component. Learn how to mitigate this high-impact security flaw.Tue, 05 May 2026 12:37:20 GMTCVE-2026-0073AndroidRCEZero ClickGooglehttps://runtimerebel.com/blog/android-dirty-stream-path-traversal-detecting-and-patching-app-exploitshttps://runtimerebel.com/blog/android-dirty-stream-path-traversal-detecting-and-patching-app-exploitsMicrosoft identifies Dirty Stream vulnerabilities in Android apps, allowing path traversal and unauthorized file manipulation. Learn how to secure your apps.Mon, 20 Apr 2026 05:08:30 GMTAndroidDirty StreamPath TraversalMobile SecurityMicrosoft Threat Intelligencehttps://runtimerebel.com/blog/cve-2024-21390-engagelab-sdk-vulnerability-risks-android-crypto-walletshttps://runtimerebel.com/blog/cve-2024-21390-engagelab-sdk-vulnerability-risks-android-crypto-walletsMicrosoft reveals a vulnerability in the EngageLab SDK affecting millions of Android crypto wallet users, potentially allowing for private key theft.Fri, 10 Apr 2026 08:39:29 GMTCVE-2024-21390AndroidEngageLabCryptocurrencySDK Vulnerabilityhttps://runtimerebel.com/blog/android-strongbox-dos-vulnerability-patched-update-nowhttps://runtimerebel.com/blog/android-strongbox-dos-vulnerability-patched-update-nowA critical Denial-of-Service vulnerability in Android's StrongBox keymaster and Framework component has been patched. Immediate updates are crucial for device security.Tue, 07 Apr 2026 16:29:56 GMTAndroidStrongBoxDoSVulnerabilityPatchMobile Securityhttps://runtimerebel.com/blog/sparkcat-mobile-malware-variant-steals-crypto-recovery-phraseshttps://runtimerebel.com/blog/sparkcat-mobile-malware-variant-steals-crypto-recovery-phrasesA new SparkCat malware variant targets iOS and Android users, stealing crypto wallet recovery phrase images from compromised apps on official stores.Fri, 03 Apr 2026 12:21:17 GMTSparkCatMobile MalwareiOSAndroidCryptocurrency TheftApp Store MalwareRecovery Phrase Thefthttps://runtimerebel.com/blog/novoice-android-malware-on-google-play-2-3-million-devices-infectedhttps://runtimerebel.com/blog/novoice-android-malware-on-google-play-2-3-million-devices-infectedNoVoice Android malware, disguised in over 50 Google Play apps, infected 2.3 million devices, exhibiting aggressive adware and subscription fraud.Wed, 01 Apr 2026 20:19:41 GMTAndroidNoVoiceGoogle PlayAdwareMalwareMobile Securityhttps://runtimerebel.com/blog/android-developer-identity-verification-new-google-play-mandateshttps://runtimerebel.com/blog/android-developer-identity-verification-new-google-play-mandatesGoogle mandates identity verification for all Android developers to reduce malicious app distribution and improve Play Store transparency starting September.Tue, 31 Mar 2026 20:17:58 GMTAndroidGoogle PlayIdentity VerificationMobile SecurityDeveloper Compliancehttps://runtimerebel.com/blog/google-play-protect-advanced-flow-for-android-sideloadinghttps://runtimerebel.com/blog/google-play-protect-advanced-flow-for-android-sideloadingGoogle introduces Advanced Flow to Play Protect, enhancing security for Android sideloading to combat financial fraud and malicious APK installations.Sat, 21 Mar 2026 16:09:55 GMTAndroidGoogle Play ProtectSideloadingMobile SecurityFintech Fraudhttps://runtimerebel.com/blog/google-android-security-24-hour-wait-for-unverified-sideloadinghttps://runtimerebel.com/blog/google-android-security-24-hour-wait-for-unverified-sideloadingGoogle introduces a mandatory 24-hour cooling-off period for sideloading unverified Android applications to mitigate malware and financial scams.Fri, 20 Mar 2026 12:17:05 GMTAndroidGoogle Play ProtectSideloadingMalware PreventionMobile Securityhttps://runtimerebel.com/blog/perseus-android-malware-technical-analysis-of-note-stealing-tacticshttps://runtimerebel.com/blog/perseus-android-malware-technical-analysis-of-note-stealing-tacticsPerseus Android malware targets sensitive secrets in user notes by abusing Accessibility Services. Learn how to detect and mitigate this mobile threat.Thu, 19 Mar 2026 12:19:37 GMTAndroidPerseusCredential TheftMobile SecurityAccessibility Serviceshttps://runtimerebel.com/blog/beatbanker-android-malware-starlink-impersonation-device-hijackhttps://runtimerebel.com/blog/beatbanker-android-malware-starlink-impersonation-device-hijackNew BeatBanker Android malware impersonates the Starlink app on fake app stores to hijack devices, targeting unsuspecting users. Learn detection & mitigation.Wed, 11 Mar 2026 00:32:24 GMTBeatBankerAndroidMalwareStarlinkMobile SecuritySideloadingBanking Malwarehttps://runtimerebel.com/blog/security-flaws-in-android-mental-health-apps-affect-14-7m-usershttps://runtimerebel.com/blog/security-flaws-in-android-mental-health-apps-affect-14-7m-usersMultiple Android mental health apps suffer from hardcoded credentials and insecure data storage, putting sensitive patient information at risk.Tue, 24 Feb 2026 08:20:26 GMTAndroidData PrivacyMental Health AppsHard Coded CredentialsAPI SecurityPaii