Cybersecurity articles tagged #Mobile Security on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/unisoc-modem-exploit-chain-android-takeover-via-video-callhttps://runtimerebel.com/blog/unisoc-modem-exploit-chain-android-takeover-via-video-callAn exploit chain targeting Unisoc modems allows remote Android device takeover through a malicious video call, requiring victim interaction.Tue, 18 Aug 2026 00:41:53 GMTAndroidMobile SecurityRemote Code ExecutionExploit ChainUnisochttps://runtimerebel.com/blog/cognyte-falconet-tactical-mobile-cell-site-simulators-and-imsi-catchershttps://runtimerebel.com/blog/cognyte-falconet-tactical-mobile-cell-site-simulators-and-imsi-catchersAn analysis of the Cognyte FalcoNet cell-site simulator, a mobile surveillance tool used for indiscriminate tracking and identification of cellular devices.Mon, 27 Jul 2026 11:27:14 GMTCognyteFalconetIMSI CatcherSurveillance TechMobile Securityhttps://runtimerebel.com/blog/fake-bahrain-alert-apps-deploy-android-surveillance-malwarehttps://runtimerebel.com/blog/fake-bahrain-alert-apps-deploy-android-surveillance-malwareAnalyzing fake Bahrain alert apps distributing four-stage Android surveillance malware via phony app stores, exploiting geopolitical tensions for extensive data…Wed, 22 Jul 2026 21:12:30 GMTAndroidMobile SecuritySpywareSurveillance MalwareFake AppsPhishingSocial EngineeringBahrainhttps://runtimerebel.com/blog/open-source-android-ai-agent-hijacking-leads-to-host-system-rcehttps://runtimerebel.com/blog/open-source-android-ai-agent-hijacking-leads-to-host-system-rceLearn how invisible text exploits open-source Android AI agents to trigger malicious code execution on host PCs via indirect prompt injection.Tue, 21 Jul 2026 13:54:29 GMTAndroid SecurityAI AgentsPrompt InjectionRCEMobile SecurityAppagenthttps://runtimerebel.com/blog/redwing-maas-android-bank-fraud-via-telegram-rental-service-analysishttps://runtimerebel.com/blog/redwing-maas-android-bank-fraud-via-telegram-rental-service-analysisRedWing MaaS is an Android bank fraud malware-as-a-service rented on Telegram, enabling low-skill attackers to steal banking logins and OTPs.Tue, 07 Jul 2026 18:01:20 GMTRedWingMaaSAndroidBanking MalwareOblivionTelegramMobile Securityhttps://runtimerebel.com/blog/pegasus-spyware-targets-mep-investigating-surveillancehttps://runtimerebel.com/blog/pegasus-spyware-targets-mep-investigating-surveillanceFormer European Parliament Member Stelios Kouloglou was repeatedly targeted with Pegasus spyware while investigating surveillance tools.Fri, 03 Jul 2026 14:09:22 GMTPegasusSpywareStelios KouloglouEuropean ParliamentCitizen LabSurveillanceMobile Securityhttps://runtimerebel.com/blog/unc5792-unc4221-target-us-officials-via-messaging-appshttps://runtimerebel.com/blog/unc5792-unc4221-target-us-officials-via-messaging-appsRussian state-linked groups UNC5792 and UNC4221 are actively targeting US government, military, and allied personnel through evolving messaging app attacks.Mon, 29 Jun 2026 10:10:24 GMTUNC5792UNC4221Russian APTMessaging App AttacksGovernment TargetingEspionageMobile Securityhttps://runtimerebel.com/blog/anthropic-s-claude-cowork-mobile-enterprise-security-implicationshttps://runtimerebel.com/blog/anthropic-s-claude-cowork-mobile-enterprise-security-implicationsAnthropic tests Claude Cowork on mobile, enabling long-running AI tasks. This analysis covers potential data, access, and shadow IT risks for security teams.Fri, 26 Jun 2026 01:02:11 GMTAnthropicClaudeAIMobile SecurityEnterprise AIData Governancehttps://runtimerebel.com/blog/shopify-shop-app-abused-for-callback-phishing-attackshttps://runtimerebel.com/blog/shopify-shop-app-abused-for-callback-phishing-attacksAttackers are exploiting the Shopify Shop app's order tracking features to launch callback phishing attacks, tricking users into installing remote access tools.Thu, 25 Jun 2026 20:47:19 GMTShopifyCallback PhishingSocial EngineeringMobile Securityhttps://runtimerebel.com/blog/rokarolla-android-malware-targets-217-financial-appshttps://runtimerebel.com/blog/rokarolla-android-malware-targets-217-financial-appsNew Rokarolla Android banking trojan targets 217 financial and crypto applications. Learn its TTPs and how to protect mobile banking apps from malware.Tue, 16 Jun 2026 21:08:26 GMTRokarollaAndroid MalwareBanking TrojanMobile SecurityFinancial ServicesOverlay Attackhttps://runtimerebel.com/blog/google-gemini-indirect-prompt-injection-via-malicious-notificationshttps://runtimerebel.com/blog/google-gemini-indirect-prompt-injection-via-malicious-notificationsSecurity researchers demonstrate how malicious notifications can manipulate Google Gemini's voice assistant to perform unauthorized tasks or exfiltrate data.Wed, 03 Jun 2026 13:49:53 GMTGoogle GeminiPrompt InjectionLLM SecurityHiddenlayerMobile Securityhttps://runtimerebel.com/blog/google-android-scam-detection-real-time-ai-defense-against-fraudhttps://runtimerebel.com/blog/google-android-scam-detection-real-time-ai-defense-against-fraudGoogle introduces AI-powered Scam Detection for Android, utilizing on-device Gemini Nano to identify fraud patterns and protect users from voice-based phishing.Wed, 03 Jun 2026 09:44:39 GMTAndroidGoogle Gemini NanoAI DeepfakesVishingMobile Securityhttps://runtimerebel.com/blog/btmob-android-malware-analyzing-phishing-driven-full-device-takeoverhttps://runtimerebel.com/blog/btmob-android-malware-analyzing-phishing-driven-full-device-takeoverBTMOB malware targets Android users via phishing, utilizing VNC and accessibility services to facilitate financial theft and total remote device control.Thu, 28 May 2026 13:26:29 GMTBTMOBAndroid MalwarePhishingVNCFinancial FraudMobile Securityhttps://runtimerebel.com/blog/apple-s-app-store-fraud-prevention-over-11b-blockedhttps://runtimerebel.com/blog/apple-s-app-store-fraud-prevention-over-11b-blockedRuntime Rebel analyzes Apple's disclosure of blocking $11B in App Store fraud over six years, detailing the ongoing fight against malicious apps.Thu, 21 May 2026 20:41:16 GMTAppleApp StoreFraudCybercrimeMobile SecurityPayment Fraudhttps://runtimerebel.com/blog/security-brief-data-breaches-shinyhunters-activity-and-app-flawshttps://runtimerebel.com/blog/security-brief-data-breaches-shinyhunters-activity-and-app-flawsAnalyzes recent security events: Nvidia cloud gaming data breach, FBI warning on ShinyHunters hacking Canvas, and critical flaws in Audi mobile applications.Fri, 15 May 2026 16:42:44 GMTNVIDIAShinyHuntersAudiData BreachMobile SecurityCloud GamingFBIhttps://runtimerebel.com/blog/windows-phone-link-abuse-cloudz-rat-bypasses-2fa-via-sms-interceptionhttps://runtimerebel.com/blog/windows-phone-link-abuse-cloudz-rat-bypasses-2fa-via-sms-interceptionHackers are deploying CloudZ RAT and its Pheno plugin to exploit Windows Phone Link, enabling 2FA bypass and SMS theft. Learn to detect and mitigate this threat.Wed, 06 May 2026 16:41:34 GMTCloudZ RATPheno PluginWindows Phone Link2FA BypassSMS InterceptionMobile Securityhttps://runtimerebel.com/blog/toronto-sms-blaster-arrests-analyzing-imsi-catcher-smishing-riskshttps://runtimerebel.com/blog/toronto-sms-blaster-arrests-analyzing-imsi-catcher-smishing-risksLaw enforcement in Toronto dismantled an illicit SMS blaster operation used for high-volume smishing. Learn how these devices bypass carrier security filters.Mon, 27 Apr 2026 20:29:15 GMTSmishingIMSI CatcherToronto PolicePhishing CampaignMobile Securityhttps://runtimerebel.com/blog/malicious-crypto-apps-on-apple-app-store-target-private-keyshttps://runtimerebel.com/blog/malicious-crypto-apps-on-apple-app-store-target-private-keysDozens of fake cryptocurrency wallet applications have been found in the Apple App Store, designed to phish users' recovery phrases and private keys, leading to…Tue, 21 Apr 2026 20:25:52 GMTCryptocurrencyMalwarePhishingApple App StoreMobile SecurityPrivate KeysRecovery Phraseshttps://runtimerebel.com/blog/android-dirty-stream-path-traversal-detecting-and-patching-app-exploitshttps://runtimerebel.com/blog/android-dirty-stream-path-traversal-detecting-and-patching-app-exploitsMicrosoft identifies Dirty Stream vulnerabilities in Android apps, allowing path traversal and unauthorized file manipulation. Learn how to secure your apps.Mon, 20 Apr 2026 05:08:30 GMTAndroidDirty StreamPath TraversalMobile SecurityMicrosoft Threat Intelligencehttps://runtimerebel.com/blog/mirax-rat-analysis-android-devices-targeted-for-proxy-node-abusehttps://runtimerebel.com/blog/mirax-rat-analysis-android-devices-targeted-for-proxy-node-abuseMirax RAT targets Android users in Europe via MaaS, converting infected devices into residential proxy nodes. Technical analysis of capabilities and TTPs.Wed, 15 Apr 2026 12:30:33 GMTMirax RATAndroid MalwareProxy BotnetMobile Securityhttps://runtimerebel.com/blog/google-workspace-cse-securing-gmail-on-android-and-ioshttps://runtimerebel.com/blog/google-workspace-cse-securing-gmail-on-android-and-iosGoogle introduces native client-side encryption for Gmail on Android and iOS, enabling enterprise users to control encryption keys on mobile devices.Mon, 13 Apr 2026 08:49:19 GMTGmailGoogle WorkspaceClient Side EncryptionData SovereigntyMobile Securityhttps://runtimerebel.com/blog/google-gmail-client-side-encryption-for-android-and-ios-deployment-guidehttps://runtimerebel.com/blog/google-gmail-client-side-encryption-for-android-and-ios-deployment-guideGoogle expands Gmail client-side encryption (CSE) to Android and iOS, giving enterprise users full control over encryption keys for mobile email communications.Fri, 10 Apr 2026 12:27:27 GMTGoogle WorkspaceGmailClient Side EncryptionMobile SecurityS MIMEData Privacyhttps://runtimerebel.com/blog/engagelab-sdk-vulnerability-protecting-crypto-wallets-from-sandbox-bypasshttps://runtimerebel.com/blog/engagelab-sdk-vulnerability-protecting-crypto-wallets-from-sandbox-bypassA flaw in EngageLab SDK exposed 50 million Android users to data theft. Learn how attackers bypass the Android sandbox to access private cryptocurrency keys.Fri, 10 Apr 2026 00:40:05 GMTEngageLab SDKAndroid SecurityCrypto Wallet VulnerabilityMicrosoft DefenderMobile Securityhttps://runtimerebel.com/blog/android-strongbox-dos-vulnerability-patched-update-nowhttps://runtimerebel.com/blog/android-strongbox-dos-vulnerability-patched-update-nowA critical Denial-of-Service vulnerability in Android's StrongBox keymaster and Framework component has been patched. Immediate updates are crucial for device security.Tue, 07 Apr 2026 16:29:56 GMTAndroidStrongBoxDoSVulnerabilityPatchMobile Securityhttps://runtimerebel.com/blog/qr-code-phishing-sms-traffic-violation-scams-bypass-mobile-filtershttps://runtimerebel.com/blog/qr-code-phishing-sms-traffic-violation-scams-bypass-mobile-filtersScammers are using QR codes in SMS traffic violation scams to bypass security filters and steal financial data. Learn how to identify and block quishing.Sun, 05 Apr 2026 20:11:44 GMTQuishingSmishingFinancial FraudMobile SecurityPhishing Scamshttps://runtimerebel.com/blog/apple-patches-darksword-for-ios-18-security-analysishttps://runtimerebel.com/blog/apple-patches-darksword-for-ios-18-security-analysisApple breaks precedent by patching the DarkSword mobile exploitation framework for iOS 18, addressing critical kernel-level risks and RCE vulnerabilities.Sat, 04 Apr 2026 08:18:32 GMTAppleIos 18DarkSwordMobile SecurityKernel Exploithttps://runtimerebel.com/blog/recent-cyber-threats-data-leaks-android-malware-critical-infra-ransomwarehttps://runtimerebel.com/blog/recent-cyber-threats-data-leaks-android-malware-critical-infra-ransomwareAnalysis of a ChatGPT data leak, the emergence of an Android rootkit, and a ransomware attack impacting a water facility. Essential insights for defenders.Fri, 03 Apr 2026 16:18:10 GMTChatGPT Data LeakAndroid RootkitRansomware AttackCritical Infrastructure SecurityMobile SecurityData Protectionhttps://runtimerebel.com/blog/shadow-ai-zero-click-exploits-expand-enterprise-mobile-attack-surfacehttps://runtimerebel.com/blog/shadow-ai-zero-click-exploits-expand-enterprise-mobile-attack-surfaceEnterprises face a growing mobile attack surface from shadow AI in apps, outdated devices, and zero-click exploits, leading to unseen risks for corporate data.Fri, 03 Apr 2026 12:23:17 GMTMobile SecurityShadow AIZero Click ExploitsAttack Surface ManagementEnterprise SecurityMobile Device Managementhttps://runtimerebel.com/blog/coruna-sophisticated-iphone-hacking-toolkit-bypasses-ios-defenseshttps://runtimerebel.com/blog/coruna-sophisticated-iphone-hacking-toolkit-bypasses-ios-defensesGoogle researchers uncovered "Coruna," a powerful iOS exploit kit leveraging 23 vulnerabilities to silently install malware on iPhones, likely state-sponsored.Thu, 02 Apr 2026 12:30:01 GMTCorunaiOSiPhoneExploit KitState SponsoredMobile Securityhttps://runtimerebel.com/blog/ios-18-7-7-update-expanded-to-mitigate-darksword-exploit-kit-riskshttps://runtimerebel.com/blog/ios-18-7-7-update-expanded-to-mitigate-darksword-exploit-kit-risksApple expands iOS 18.7.7 and iPadOS 18.7.7 availability to additional devices to mitigate risks from the recently disclosed DarkSword exploit kit.Thu, 02 Apr 2026 08:27:29 GMTAppleiOSDarkSwordExploit KitMobile Securityhttps://runtimerebel.com/blog/novoice-android-malware-on-google-play-2-3-million-devices-infectedhttps://runtimerebel.com/blog/novoice-android-malware-on-google-play-2-3-million-devices-infectedNoVoice Android malware, disguised in over 50 Google Play apps, infected 2.3 million devices, exhibiting aggressive adware and subscription fraud.Wed, 01 Apr 2026 20:19:41 GMTAndroidNoVoiceGoogle PlayAdwareMalwareMobile Securityhttps://runtimerebel.com/blog/fbi-warning-assessing-data-security-risks-of-chinese-mobile-applicationshttps://runtimerebel.com/blog/fbi-warning-assessing-data-security-risks-of-chinese-mobile-applicationsThe FBI warns against data security risks associated with foreign-developed mobile applications, particularly Chinese apps, due to potential data exfiltration.Wed, 01 Apr 2026 12:27:27 GMTMobile SecurityData PrivacyFBI WarningData ExfiltrationChinaSupply Chain Riskhttps://runtimerebel.com/blog/android-developer-identity-verification-new-google-play-mandateshttps://runtimerebel.com/blog/android-developer-identity-verification-new-google-play-mandatesGoogle mandates identity verification for all Android developers to reduce malicious app distribution and improve Play Store transparency starting September.Tue, 31 Mar 2026 20:17:58 GMTAndroidGoogle PlayIdentity VerificationMobile SecurityDeveloper Compliancehttps://runtimerebel.com/blog/star-blizzard-apt28-adopts-darksword-ios-exploit-kithttps://runtimerebel.com/blog/star-blizzard-apt28-adopts-darksword-ios-exploit-kitRussian APT Star Blizzard (APT28) now uses the DarkSword iOS exploit kit to target government, finance, and academia, increasing mobile threat exposure.Mon, 30 Mar 2026 12:35:23 GMTStar BlizzardAPT28Fancy BearNobeliumDarkSwordiOSExploit KitState SponsoredMobile SecuritySpear Phishinghttps://runtimerebel.com/blog/apple-ios-lock-screen-alerts-warn-of-active-web-based-exploitshttps://runtimerebel.com/blog/apple-ios-lock-screen-alerts-warn-of-active-web-based-exploitsApple is now issuing direct Lock Screen notifications to warn users on outdated iOS versions about active web-based attacks and the need for urgent updates.Fri, 27 Mar 2026 20:14:32 GMTAppleiOSiPadOSWeb Based AttacksMobile SecurityPatch Managementhttps://runtimerebel.com/blog/google-play-protect-advanced-flow-for-android-sideloadinghttps://runtimerebel.com/blog/google-play-protect-advanced-flow-for-android-sideloadingGoogle introduces Advanced Flow to Play Protect, enhancing security for Android sideloading to combat financial fraud and malicious APK installations.Sat, 21 Mar 2026 16:09:55 GMTAndroidGoogle Play ProtectSideloadingMobile SecurityFintech Fraudhttps://runtimerebel.com/blog/google-android-security-24-hour-wait-for-unverified-sideloadinghttps://runtimerebel.com/blog/google-android-security-24-hour-wait-for-unverified-sideloadingGoogle introduces a mandatory 24-hour cooling-off period for sideloading unverified Android applications to mitigate malware and financial scams.Fri, 20 Mar 2026 12:17:05 GMTAndroidGoogle Play ProtectSideloadingMalware PreventionMobile Securityhttps://runtimerebel.com/blog/perseus-android-malware-technical-analysis-of-note-stealing-tacticshttps://runtimerebel.com/blog/perseus-android-malware-technical-analysis-of-note-stealing-tacticsPerseus Android malware targets sensitive secrets in user notes by abusing Accessibility Services. Learn how to detect and mitigate this mobile threat.Thu, 19 Mar 2026 12:19:37 GMTAndroidPerseusCredential TheftMobile SecurityAccessibility Serviceshttps://runtimerebel.com/blog/whatsapp-view-once-bypass-via-modified-clients-meta-won-t-patchhttps://runtimerebel.com/blog/whatsapp-view-once-bypass-via-modified-clients-meta-won-t-patchA new WhatsApp View Once bypass allows recipients to persist media via modified clients. Meta declines patching, citing client-side enforcement limits.Wed, 18 Mar 2026 12:24:28 GMTWhatsAppView Once BypassPrivacyMetaMobile Securityhttps://runtimerebel.com/blog/android-17-restricts-accessibility-api-to-thwart-malware-abusehttps://runtimerebel.com/blog/android-17-restricts-accessibility-api-to-thwart-malware-abuseAndroid 17 Beta 2 introduces restrictions on the Accessibility API under Advanced Protection Mode to prevent malware from hijacking system permissions.Mon, 16 Mar 2026 08:29:09 GMTAndroid 17Accessibility ApiGoogle Play ProtectAapmMobile Securityhttps://runtimerebel.com/blog/smartphone-phishing-bypasses-protections-ai-s-role-in-defensehttps://runtimerebel.com/blog/smartphone-phishing-bypasses-protections-ai-s-role-in-defenseSophisticated Phishing attacks are increasingly bypassing smartphone protections. This analysis explores AI's potential role in defense and critical user safeguards.Fri, 13 Mar 2026 16:21:11 GMTPhishingMobile SecurityAIConsumer ProtectionOmdiahttps://runtimerebel.com/blog/beatbanker-android-malware-starlink-impersonation-device-hijackhttps://runtimerebel.com/blog/beatbanker-android-malware-starlink-impersonation-device-hijackNew BeatBanker Android malware impersonates the Starlink app on fake app stores to hijack devices, targeting unsuspecting users. Learn detection & mitigation.Wed, 11 Mar 2026 00:32:24 GMTBeatBankerAndroidMalwareStarlinkMobile SecuritySideloadingBanking Malwarehttps://runtimerebel.com/blog/qualcomm-0-day-and-ios-exploit-chains-impact-mitigation-strategieshttps://runtimerebel.com/blog/qualcomm-0-day-and-ios-exploit-chains-impact-mitigation-strategiesThis weekly recap details active exploitation of a Qualcomm zero-day, iOS exploit chains, and emerging 'AirSnitch' attack methods. Learn what defenders should prioritize.Mon, 09 Mar 2026 16:32:02 GMTQualcommiOSZero-DayExploit ChainAirsnitchVibe Coded MalwareMobile Securityhttps://runtimerebel.com/blog/2025-zero-day-exploitation-review-enterprise-os-targets-dominatehttps://runtimerebel.com/blog/2025-zero-day-exploitation-review-enterprise-os-targets-dominateGTIG's 2025 zero-day review reveals 90 in-the-wild exploits, with a record 48% targeting enterprise tech and a surge in OS vulnerabilities. Includes actor TTPs.Thu, 05 Mar 2026 16:27:26 GMTZero-DayThreat IntelligenceEnterprise SecurityMobile SecurityState Sponsored ExploitationCommercial Surveillance VendorsPRC NexusFinancially MotivatedCVE-2025-21590CVE-2025-0282CVE-2025-61882CVE-2025-61884CVE-2025-8088CVE-2025-2783CVE-2025-48543CVE-2025-27038CVE-2025-6558CVE-2025-14174CVE-2025-40602CVE-2025-21043CVE-2025-43300SonicWall SMAOracle E Business SuiteWinRARhttps://runtimerebel.com/blog/badesaba-calendar-app-compromised-in-state-linked-propaganda-campaignhttps://runtimerebel.com/blog/badesaba-calendar-app-compromised-in-state-linked-propaganda-campaignAn analysis of the BadeSaba Calendar hack, where five million Iranian users received propaganda notifications during kinetic strikes, highlighting PsyOps risks.Thu, 05 Mar 2026 12:22:03 GMTBadeSaba CalendarPropaganda CampaignMobile SecurityPush Notification HackInformation Warfarehttps://runtimerebel.com/blog/russian-coruna-ios-exploit-kit-targets-global-users-analysishttps://runtimerebel.com/blog/russian-coruna-ios-exploit-kit-targets-global-users-analysisSecurity researchers uncover the Coruna iOS exploit kit, a nation-state tool now used in broader campaigns to deliver spyware to mobile devices.Thu, 05 Mar 2026 04:40:41 GMTCorunaiOS SpywareAPT28Google TAGiVerifyMobile Securityhttps://runtimerebel.com/blog/coruna-ios-exploit-kit-spyware-grade-threat-targets-cryptohttps://runtimerebel.com/blog/coruna-ios-exploit-kit-spyware-grade-threat-targets-cryptoThe sophisticated Coruna iOS exploit kit, leveraging 23 undocumented vulnerabilities, is now deployed in targeted espionage and crypto theft attacks.Wed, 04 Mar 2026 20:15:16 GMTCorunaiOSExploit KitMobile SecurityCrypto TheftEspionageZero-Dayhttps://runtimerebel.com/blog/nato-approves-apple-iphone-and-ipad-for-classified-communicationshttps://runtimerebel.com/blog/nato-approves-apple-iphone-and-ipad-for-classified-communicationsApple iOS and iPadOS devices added to NATO’s NIAPC, authorizing their use for handling NATO Restricted level classified information and communications.Thu, 26 Feb 2026 20:15:44 GMTNATOAppleiOSiPadOSNIAPCMobile SecurityClassified Information