42251
Mobile cybersecurity channel Links: https://linktr.ee/mobilehacker Contact: mobilehackerofficial@gmail.com
Analysis of Android DHCSpy operated by the Iranian APT MuddyWater
https://shindan.io/blog/dhcspy-discovering-the-iranian-apt-muddywater
Writeup for CVE-2025-24085, an ITW iOS mediaplaybackd vulnerability patched earlier this year
https://github.com/b1n4r1b01/n-days/blob/main/CVE-2025-24085/CVE-2025-24085.md
Banker Trojan Targeting Indonesian and Vietnamese Android Users
https://dti.domaintools.com/banker-trojan-targeting-indonesian-and-vietnamese-android-users/
Finding vulnerabilities in the Binder kernel driver through fuzzing
https://androidoffsec.withgoogle.com/posts/binder-fuzzing/
Trigger for the integer underflow bug in the HID core subsystem (CVE-2025-38494 and CVE-2025-38495) that leaks 64 KB of OOB memory over USB
Still works on Pixels and Ubuntus (but the bug is fixed in stable kernels)
https://github.com/xairy/kernel-exploits/tree/master/CVE-2025-38494
Android SlopAds Fraud with Layers of Obfuscation
https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-slopads-covers-fraud-with-layers-of-obfuscation/
Wanted to spy on my dog, ended up spying on TP-Link (TP-Link Tapo app)
https://kennedn.com/blog/posts/tapo/
PhantomCall unmasked: An Antidot variant disguised as fake Chrome apps in a global banking malware campaign
https://www.ibm.com/think/news/phantomcall-antidot-variant-in-fake-chrome-apps
The Rise of RatOn: From NFC heists to remote control and ATS
https://www.threatfabric.com/blogs/the-rise-of-raton-from-nfc-heists-to-remote-control-and-ats
CoRCTF 2025 - CoRPhone: Android Kernel Pwn
CoRPhone is an Android kernel exploitation challenge created for CoRCTF 2025. It simulates a scenario in which a kernel exploit is delivered as shellcode and executed in memory by an untrusted Android app.
https://github.com/0xdevil/corphone/tree/main
[beginners] Building an Android Bug Bounty lab - guide to configuring emulators, real devices, proxies, Magisk, Burp, Frida
https://www.yeswehack.com/learn-bug-bounty/android-lab-mobile-hacking-tools
Critical CVE-2025-48539 Android RCE allows an attacker within physical or network proximity, such as Bluetooth or WiFi range, to execute arbitrary code on the device without any user interaction or privileges
https://osv.dev/vulnerability/ASB-A-406785684
https://grok.com/s/bGVnYWN5_f5103b21-64a1-4b1c-beaf-184a290ca23d
SSLPinDetect: Advanced SSL Pinning Detection for Android Security Analysis
Blog: https://petruknisme.medium.com/sslpindetect-advanced-ssl-pinning-detection-for-android-security-analysis-1390e9eca097
Tool: https://github.com/aancw/SSLPinDetect
WhatsApp Zero-Day Vulnerability Exploited with 0-Click Attacks to Hack Apple Devices
https://gbhackers.com/whatsapp-zero-day-vulnerability-exploited-with-0-click-attacks/
GodFather - Part 1 - A multistage dropper
https://shindan.io/blog/godfather-part-1-a-multistage-dropper
Exploring Android Accessibility Malware | Droidcon Italy 2024
https://www.youtube.com/watch?v=xCHW8ql3vi0
Triggered WhatsApp 0-click on iOS/macOS/iPadOS
CVE-2025-55177 arises from missing validation that the [Redacted] message originates from a linked device, enabling specially crafted DNG parsing that triggers CVE-2025-43300.
Analysis of Samsung CVE-2025-21043 is also ongoing
Source: https://x.com/DarkNavyOrg/status/1972260639101034950
Obtain a root shell on Unisoc unpatched devices (CVE-2025-31710)
https://github.com/Skorpion96/unisoc-su/tree/main?tab=readme-ov-file
CVE-2025-10184 is permission bypass that affects multiple OnePlus devices running OxygenOS 12–15 (NOT FIXED) with PoC
This vulnerability allows any application installed on the device to read SMS/MMS without permission, user interaction, or consent.
https://www.rapid7.com/blog/post/cve-2025-10184-oneplus-oxygenos-telephony-provider-permission-bypass-not-fixed/
Automating Android Component Testing with new APK Inspector tool
-What are exported components?
-Setup and testing APK Inspector
-Improve automation and execute ADB commands interactively
-Run it on Android
-What are Intent Redirection Vulnerabilities?
https://www.mobile-hacker.com/2025/09/18/automating-android-app-component-testing-with-new-apk-inspector/
NFC Card Vulnerability Exploitation Leading to Free Top-Up in KioSoft "Stored Value" Unattended Payment Solution (Mifare) CVE-2025-8699
https://sec-consult.com/vulnerability-lab/advisory/nfc-card-vulnerability-exploitation-leading-to-free-top-up-kiosoft-payment-solution/
Strategies for Analyzing Native Code in Android Applications: Combining Ghidra and Symbolic Execution for Code Decryption and Deobfuscation
https://revflash.medium.com/strategies-for-analyzing-native-code-in-android-applications-combining-ghidra-and-symbolic-aaef4c9555df
Analysis of P2P cheap "spy" cameras and their LookCam app
https://palant.info/2025/09/08/a-look-at-a-p2p-camera-lookcam-app
Analysis of CVE-2025-38352 and technical insights into process of triggering the bug that caused a crash in the Android kernel. It was released in the September 2025 Android Bulletin, marked as possibly under limited, targeted exploitation.
https://streypaws.github.io/posts/Race-Against-Time-in-the-Kernel-Clockwork/
Agentic Discovery and Validation of Android App Vulnerabilities
https://arxiv.org/pdf/2508.21579v1
Reverse engineering of Apple's iOS 0-click CVE-2025-43300
https://blog.quarkslab.com/patch-analysis-of-Apple-iOS-CVE-2025-43300.html
Android Droppers: The Silent Gatekeepers of Malware
https://www.threatfabric.com/blogs/android-droppers-the-silent-gatekeepers-of-malware
SikkahBot Malware Campaign Lures and Defrauds Students in Bangladesh
https://cyble.com/blog/sikkahbot-malware-defrauds-students-in-bangladesh/
Threat Actors Use Facebook Ads to Deliver Android Malware
https://www.bitdefender.com/en-us/blog/labs/malvertising-campaign-on-meta-expands-to-android-pushing-advanced-crypto-stealing-malware-to-users-worldwide
Sotap — A lightweight .so library for logging the behavior of JNI libraries
https://github.com/RezaArbabBot/SoTap