44609
Mobile cybersecurity channel Links: https://linktr.ee/mobilehacker Contact: mobilehackerofficial@gmail.com
Hacking My Car, and probably yours— Security Flaws in Volkswagen’s App
https://loopsec.medium.com/hacking-my-car-and-probably-yours-security-flaws-in-volkswagens-app-24b34c47ba89
PAPIMonitor: python tool based on Frida for monitoring user-select APIs during the app execution
https://github.com/Dado1513/PAPIMonitor
HacknDroid: Automation of some MAPT activities and interaction with the mobile Android device
Prerequisites:
adb enabled ✅
device authorized ✅
https://github.com/RaffaDNDM/HacknDroid
The Human Interface Device Attack from the Perspective of the Attacker and the Forensic Analyst
https://www.researchgate.net/publication/365110681_The_Human_Interface_Device_Attack_from_the_Perspective_of_the_Attacker_and_the_Forensic_Analyst
Advanced Anti-Forensic Protection of Mobile Applications
https://www.researchgate.net/publication/375258345_Advanced_Anti-Forensic_Protection_of_Mobile_Applications
TM SGNL, the obscure unofficial Signal app Mike Waltz uses to text with Trump officials
Analysis: https://micahflee.com/tm-sgnl-the-obscure-unofficial-signal-app-mike-waltz-uses-to-text-with-trump-officials/
Source code: https://micahflee.com/heres-the-source-code-for-the-unofficial-signal-app-used-by-trump-officials/
AirBorne: Wormable Zero-Click Remote Code Execution (RCE) in AirPlay Protocol Puts Apple & IoT Devices at Risk
https://www.oligo.security/blog/airborne
Rooting an Android Emulator for Mobile Security Testing
https://8ksec.io/rooting-an-android-emulator-for-mobile-security-testing/
SuperCard X: exposing a Chinese-speaker MaaS for NFC Relay fraud operation
https://www.cleafy.com/cleafy-labs/supercardx-exposing-chinese-speaker-maas-for-nfc-relay-fraud-operation?s=03
Android spyware trojan targets Russian military personnel who use Alpine Quest mapping software
https://news.drweb.com/show/?i=15006&lng=en&c=5
B(l)utter: Flutter Mobile Application Reverse Engineering Tool
https://github.com/worawit/blutter
Magisk for Mobile Pentesting: Rooting Android Devices and Building Custom Modules
Part 1: justmobilesec/magisk-for-mobile-pentesting-rooting-android-devices-and-building-custom-modules-part-i-3ca7429f1faf" rel="nofollow">https://medium.com/@justmobilesec/magisk-for-mobile-pentesting-rooting-android-devices-and-building-custom-modules-part-i-3ca7429f1faf
Part 2: justmobilesec/magisk-for-mobile-pentesting-rooting-android-devices-and-building-custom-modules-part-ii-22badc498437" rel="nofollow">https://medium.com/@justmobilesec/magisk-for-mobile-pentesting-rooting-android-devices-and-building-custom-modules-part-ii-22badc498437
Rethinking Emulation for Fu(zzi)n(g) and Profit: Near-Native Rehosting for Embedded ARM Firmware
[Presentation] https://www.youtube.com/watch?v=o_ckTnTQlfs
[Slides] https://github.com/binarly-io/Research_Publications/blob/main/REverse_2025/Near-Native%20Rehosting%20for%20Embedded%20ARM%20Firmware.pdf
Newly Registered Domains Distributing SpyNote Malware
https://dti.domaintools.com/newly-registered-domains-distributing-spynote-malware/
SMS Pumping: How Criminals Turn Your Messaging Service into Their Cash Machine
https://www.group-ib.com/blog/sms-pumping/
Advanced Protection: Google’s Strongest Security for Mobile Devices
https://security.googleblog.com/2025/05/advanced-protection-mobile-devices.html
WireWatch, a large-scale measurement pipeline to evaluate the network security of Android apps. WireWatch measures apps' usage of plaintext network traffic and non-standard, proprietary network cryptography.
https://www.computer.org/csdl/proceedings-article/sp/2025/223600d916/26hiVQjbZqE
KALEIDOSCOPE: Evolution of Ad Fraud Exploiting App Stores as a Front
https://go.integralads.com/rs/469-VBI-606/images/AMER_Threat_Lab_Kaleidoscope_Report_IAS.pdf
The Human Interface Device (HID) Attack on Android Lock Screen Non-Biometric Protections and Its Computational Complexity
https://www.researchgate.net/publication/361992079_The_Human_Interface_Device_HID_Attack_on_Android_Lock_Screen_Non-Biometric_Protections_and_Its_Computational_Complexity
Ollama LLM with jadx for APK analysis
https://github.com/zinja-coder/zin-mcp-client
EvilNotify: Single line of code could soft-brick iPhones by sending malicious notifications (CVE-2025-24091)
https://rambo.codes/posts/2025-04-24-how-a-single-line-of-code-could-brick-your-iphone
Triada strikes back
https://securelist.com/triada-trojan-modules-analysis/116380/
CVE-2024-53104 proof of concept: Privilege escalation security flaw in the Android Kernel's USB Video Class driver that allows authenticated local threat actors to elevate privileges in low-complexity attacks
https://github.com/zhuowei/facedancer/blob/rawgadget2/examples/camera.py#L15
Everyone knows your location: tracking myself down through in-app ads
Part 1: https://timsh.org/tracking-myself-down-through-in-app-ads/
Part 2: https://timsh.org/everyone-knows-your-location-part-2-try-it-yourself/
Plus a guide that helps to collect, analyze and visualize requests sent by a mobile device while using some app: https://github.com/tim-sha256/analyse-ad-traffic
SpyMax Variant Targeting Chinese-Speaking Users
https://threatmon.io/spymax-variant-targeting-chinese-speaking-users/
Intercepting HTTPS Communication in Flutter: Going Full Hardcore Mode with Frida
https://sensepost.com/blog/2025/intercepting-https-communication-in-flutter-going-full-hardcore-mode-with-frida/
Shibai: Trojanized version of WhatsApp that comes preinstalled on some low-cost Android phones. Altered using LSPatch, it replaces cryptocurrency addresses in messages and redirects update URLs to retain control
https://news.drweb.com/show/?lng=en&i=15002&c=5
Android Kernel Adventures: Insights into Compilation, Customization and Application Analysis
https://revflash.medium.com/android-kernel-adventures-insights-into-compilation-customization-and-application-analysis-d20af6f2080a
A Random and Simple Tip: Advanced Analysis of JNI Methods Using Frida
https://revflash.medium.com/a-random-and-simple-tip-advanced-analysis-of-jni-methods-using-frida-8b948ffcc8f5
Overview of the PlayPraetor Masquerading Party Variants
https://www.ctm360.com/reports/play-masquerading-party-report