Loading story…
Security researchers have identified significant risks stemming from both legitimate and malicious Android applications due to insecure or outdated embedded components. One report highlights that thousands of popular Android apps, including those in travel, weather, and airline categories, still contain the deprecated libmapbox-gl.so library, which statically links to an outdated and vulnerable version of SQLite (3.24.0). This exposes users and enterprises to threats such as credential theft, data exfiltration, and denial-of-service attacks, especially in BYOD environments where employees may unknowingly install these apps on corporate devices.
Separately, advanced malicious Android apps are employing sophisticated evasion techniques to bypass antivirus detection. These apps use strong packing and obfuscation, multi-stage payload delivery, and custom package installers to avoid analysis and facilitate the installation of additional malicious components. The malicious behaviors include information theft and coin mining, with payloads often hidden in encrypted files or triggered only under specific conditions, making detection and remediation more challenging for security teams.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
AhnLab ASEC published an analysis report on malicious apps using advanced detection and evasion techniques, indicating new technical details about Android malware behavior. No more specific event date is available from the reference, so the publication date is used.
Zimperium published a blog post titled "Follow the Map to Enterprise Risk: What’s Inside Popular Android Apps," describing security risks associated with widely used Android applications. No more specific event date is available from the reference, so the publication date is used.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have uncovered significant security and privacy issues in Android mobile applications, particularly those in the healthcare sector. A comprehensive study analyzed 272 healthcare-related Android apps, revealing that many transmit sensitive user data without encryption, store files insecurely, or share information with third-party components without adequate safeguards. The research team employed multiple static analysis tools, including MobSF, RiskInDroid, and OWASP Mobile Audit, to assess the security posture of these apps. MobSF identified weaknesses in permissions, network handling, certificate management, and manifest configuration, with app security scores ranging from 35 to 60 out of 100. RiskInDroid found that 150 apps used undeclared permissions, potentially creating hidden channels for data exfiltration, and flagged proprietary permissions that could bypass standard Android security controls. The OWASP Mobile Audit of 95 apps detected issues such as unencrypted local storage, hardcoded credentials, and missing input validation, mapping these weaknesses to the OWASP Mobile Top 10 categories. In parallel, researchers have demonstrated that some Android apps can bypass operating system permissions to access sensitive data through hidden methods and side-channel attacks. One such attack, dubbed 'Pixnapping' and tracked as CVE-2025-48561, allows a malicious app to capture screen display pixels, potentially exposing sensitive information like two-factor authentication codes. The Pixnapping attack was demonstrated on multiple devices, including Google Pixel 6 through 9 and Samsung Galaxy S25, and is conceptually similar to a 12-year-old browser-based data-stealing technique. Despite previous attempts by Google to address this vulnerability, researchers showed that the flaw remains exploitable on Android versions 13 to 16. The ability of apps to sidestep permissions and leverage hardware side channels raises serious concerns about the effectiveness of current Android security controls. These findings highlight the urgent need for stronger app vetting processes, improved permission management, and enhanced user awareness regarding the risks of installing mobile applications. The exposure of sensitive healthcare data is particularly alarming, given the potential for identity theft, fraud, and privacy violations. Security experts recommend that users exercise caution when granting permissions to apps and that developers adhere to best practices for secure coding and data protection. The research underscores the importance of regular security assessments and updates to address emerging threats in the mobile ecosystem. Industry standards such as the OWASP Mobile Top 10 provide a useful framework for identifying and mitigating common vulnerabilities. The ongoing discovery of new attack vectors, such as Pixnapping, demonstrates that attackers continue to innovate, necessitating a proactive and layered approach to mobile security. Organizations handling sensitive data, especially in healthcare, must prioritize mobile app security to protect user privacy and comply with regulatory requirements. The convergence of insecure app design and advanced attack techniques poses a growing threat to the confidentiality and integrity of user data on Android devices.
Jun 29, 2026
GitHub Security Lab reported that targeted, AI-assisted taskflows identified and disclosed 24 Android vulnerabilities in open-source applications. The workflows direct an open-source AI security agent to map mobile attack surfaces, locate entry points such as exported components and deep links, and evaluate Android-specific flaw classes; researchers emphasized that analysts must still validate findings and build proof-of-concept exploits because LLM output can overstate impact or produce false positives. In OsmAnd, an exported `MapActivity` accepted attacker-controlled intent extras that could silently import and replace application settings. A permissionless malicious app could use the issue to redirect map-tile or routing traffic and potentially infer a victim's location, routes, origin, and destination. In Wikipedia for Android, researchers found two inadequate hostname-suffix checks that could be chained through a `wikipedia://` deep link to load attacker-controlled content, expose Wikimedia cookies, and enable account takeover across Wikimedia projects.
Sep 28, 2026
Multiple security researchers have reported a significant escalation in Android-targeted threats, including the discovery of new malware families, pre-installed trojans, and spyware on both counterfeit and budget smartphones. The Triada trojan continues to be found pre-installed on counterfeit Android devices, granting attackers full device control and enabling credential theft, botnet enrollment, and unauthorized access to sensitive apps. In parallel, certain budget Samsung phones have reportedly shipped with an unremovable system app, AppCloud, described as spyware that collects sensitive user data and cannot be removed without voiding the warranty. These findings highlight the persistent risks associated with purchasing devices from untrusted sources and the growing sophistication of supply chain threats. The overall threat landscape for Android users has intensified in 2025, with a marked increase in malware, adware, and potentially unwanted program (PUP) detections. Attackers are shifting from nuisance apps to more covert tools capable of harvesting data, intercepting messages, and facilitating account takeovers. The rise in SMS-based attacks and the integration of advanced capabilities, such as one-time passcode theft, underscore the need for heightened vigilance and robust mobile security practices. Security experts emphasize the importance of verifying device integrity, using only official firmware, and implementing strict security policies to mitigate these evolving threats.
Jun 29, 2026