44609
Mobile cybersecurity channel Links: https://linktr.ee/mobilehacker Contact: mobilehackerofficial@gmail.com
eSIM might not be as safe as you think: researchers hack and clone numbers
https://security-explorations.com/esim-security.html
Chat without internet via Bluetooth
It is open-source, private, secure messaging app without needing the internet, that relies on Bluetooth mesh network
Info: https://www.mobile-hacker.com/2025/07/10/offline-encrypted-and-private-messaging-using-new-bitchat-bluetooth-app/
Download the latest app: https://github.com/permissionlesstech/bitchat-android/releases
PerfektBlue Bluetooth attack allows hacking using 1-click RCE infotainment systems of Mercedes, Volkswagen, and Skoda (CVE-2024-45431, CVE-2024-45432, CVE-2024-45433, CVE-2024-45434)
https://perfektblue.pcacybersecurity.com/
The first version of Bitchat Android app was published
It is open-source, private, secure messaging app without needing the internet, that relies on Bluetooth mesh network
https://www.mobile-hacker.com/2025/07/10/offline-encrypted-and-private-messaging-using-new-bitchat-bluetooth-app/
Anatsa Android Banking Trojan Infects 90,000 Users via Fake PDF App on Google Play
https://www.threatfabric.com/blogs/anatsa-targets-north-america-uses-proven-mobile-campaign-process
Vibe Hacking with Nmap using Android
https://www.mobile-hacker.com/2025/07/07/vibe-hacking-with-nmap-using-android/
IconAds scheme: A collection of 352 apps which load out-of-context ads on a user’s screen and hide the app icons
https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-iconads/
Qwizzserial malware steals banking information and intercepts 2FA SMS targeting Uzbekistan
https://www.group-ib.com/blog/rise-of-qwizzserial/
Bluetooth gap turns headphones into listening stations
CVE-2025-20700: Missing Authentication for GATT Services
CVE-2025-20701: Missing Authentication for Bluetooth BR/EDR
CVE-2025-20702: Critical Capabilities of a Custom Protocol
https://insinuator.net/2025/06/airoha-bluetooth-security-vulnerabilities/
How to debug binaries using GDB in Android within Termux
https://ad2001.com/blog/gdb-inside-device
Reverse Engineering the Android Malware Targeting CBE Users
https://www.linkedin.com/pulse/reverse-engineering-new-android-malware-targeting-ukfie/
SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play
https://securelist.com/sparkkitty-ios-android-malware/116793/
Fake Play and Allegro Apps - a threat to Android users by Crocodilus banker
https://www.sirt.pl/falszywe-aplikacje-play-i-allegro-zagrozenie-dla-uzytkownikow-androida/
Malicious Loan App Removed from iOS and Google Play App Store Posed Severe Risks to Users
https://blog.checkpoint.com/research/malicious-loan-app-removed-from-ios-and-google-play-app-store-posed-severe-risks-to-users/v
How to fix Metasploit in Stryker
Metasploit stuck on init? Yoro from the Stryker community shared a script to fix it
script: https://www.mobile-hacker.com/2025/06/12/stryker-app-goes-free-the-ultimate-mobile-pentesting-toolkit/
Shizuku unlocks advanced functionality on any Android
Using Shizuku app your Android gains ADB (Shell) privileges to remove bloatware, list running processes, open listening ports, view stored Wi-Fi passwords, inspect logcat of other apps, enable/disable specific Android app components etc.
https://www.mobile-hacker.com/2025/07/14/shizuku-unlocking-advanced-android-capabilities-without-root/
How Malicious Android Apps Can Impersonate Yours Using Deep Links
frankheat/how-malicious-android-apps-can-impersonate-yours-using-deep-links-8eac7f245aaf" rel="nofollow">https://medium.com/@frankheat/how-malicious-android-apps-can-impersonate-yours-using-deep-links-8eac7f245aaf
How to setup Hijacker app on Samsung Galaxy S10 with wireless injection
https://forums.kali.org/t/hijacker-on-the-samsung-galaxy-s10-with-wireless-injection/10305
TapTrap: It’s attack on Android where a dedicated app uses animation to lure you into tapping on the screen and performing unwanted actions without your consent #Tapjacking
TapTrap to enable camera access for a website via Chrome browser.
https://taptrap.click/
How to Install Gemini CLI on Android using Termux
https://www.mobile-hacker.com/2025/07/09/how-to-install-gemini-cli-on-android-using-termux/
Taking over 60k spyware user accounts with SQL injection
https://ericdaigle.ca/posts/taking-over-60k-spyware-user-accounts/
Android on-device fuzzing: Reproducing a WhatsApp bug with AFL & Frida (CVE-2019-11932)
https://www.ibm.com/think/x-force/reproducing-million-dollar-bug-whatsapp-cve-2019-11932-afl-frida
The Ullu app (Web, Android, iOS) parental PIN protection can be bypassed via brute force techniques (CVE-2025-45083) https://pastebin.com/mFM1a3CP
Читать полностью…
A Tale of Breaking Android Decompilers and Unpackers
https://ad2001.com/blog/The%20Tale%20of%20Breaking%20Android%20Decompilers
Insecure Local Storage of Sensitive Payment and User Data on external storage by Airtel Android App (com.myairtelapp) (CVE-2025-5154)
https://github.com/honestcorrupt/-CVE-Proof-of-Concept-Airtel-Android-App-Insecure-Local-Storage-of-Sensitive-Data
FileFix – New Alternative to ClickFix Attack
https://www.mobile-hacker.com/2025/06/24/introducing-filefix-a-new-alternative-to-clickfix-attacks/
SpyMax – A Fake Wedding Invitation App Targeting Indian Mobile Users
https://labs.k7computing.com/index.php/spymax-a-fake-wedding-invitation-app-targeting-indian-mobile-users/
Your Mobile App, Their Playground: The Dark side of the Virtualization by GodFather malware
https://zimperium.com/blog/your-mobile-app-their-playground-the-dark-side-of-the-virtualization
Exploiting Unsanitized URL Handling and SQL Injection through Deep Links in iOS App: Write-up of Flipcoin Lab
https://infosecwriteups.com/exploiting-unsanitized-url-handling-sql-injection-via-deep-links-in-ios-app-write-up-of-flipcoin-066899b09fc2
How to use ADB & fastboot in Termux without root
You can use non-rooted Android to unlock bootloader, run ADB commands, remove bloatware, flash ROM, or even root another Android
https://www.mobile-hacker.com/2025/06/16/how-to-run-adb-and-fastboot-on-a-non-rooted-android-smartphone-using-termux/