Loading story…
Google announced updated Android Theft Protection capabilities aimed at reducing account takeover and financial fraud risks following device theft, with availability starting on devices running Android 16+. The updates strengthen authentication safeguards by making screen lock guessing harder (longer lockout periods after repeated failed PIN/pattern/password attempts) and by improving controls around lock behavior after excessive failed authentications, including a dedicated settings toggle for Failed Authentication Lock.
Google also expanded Identity Check—which requires biometric authentication for sensitive actions when the device is outside trusted places—to cover a broader set of actions and apps that use the Android Biometric Prompt, including third-party banking apps and Google Password Manager. In parallel, Android’s Remote Lock capabilities were highlighted as part of the theft-response toolset, giving users more control to lock a lost or stolen device and limit further misuse.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Google said the new authentication safeguards are rolling out to Android 16+ devices, while enhanced Remote Lock recovery protections are being made available on Android 10+ devices. Multiple reports described the features as available now or rolling out following the announcement.
As part of the January 2026 update, Google said newly activated Android devices in Brazil will have Theft Detection Lock and Remote Lock enabled by default. The change uses on-device AI theft detection and reflects a regional hardening step for out-of-the-box protection.
Google announced a new set of Android theft-protection updates aimed at reducing device takeover, financial fraud, and data theft after phone theft. The update includes stronger screen-lock guessing defenses, broader Identity Check coverage, a dedicated Failed Authentication Lock toggle, and an optional ownership challenge for Remote Lock.
Google first introduced Android theft protection features, which later updates would build on. Subsequent reporting says these protections were first introduced in October 2024.
Google began beta testing key Android theft-protection features in Brazil, a high-risk market for phone theft, according to later reporting. The testing preceded a broader policy change to enable some protections by default on new devices in the country.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
zdnet.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourcesecurityonline.info
Open sourcezdnet.com
Open sourcesecurity.googleblog.com
Open sourcesecurity.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has expanded Android protections that tie a phone number to a device and Google accounts, while also adding **fake call detection** aimed at stopping deepfake-enabled phone scams. Reporting on the new anti-scam feature indicates Android can analyze calls for signs of impersonation and other fraudulent behavior, reflecting Google’s broader push to harden mobile devices against voice-based social engineering attacks. Separate reporting on Android’s phone number verification shows Google verifies that a SIM associated with a number is physically present in a device, then links that verified number to active Google accounts for services including **RCS messaging**, account recovery, emergency features, and anti-scam protections. The process has used hidden SMS messages and now increasingly relies on carrier APIs that exchange encrypted device and SIM-related data; the feature is enabled by default, can generate “number is now verified” alerts, and has raised privacy concerns because one verified number may be associated with multiple Google accounts on the same device.
Jul 22, 2026
Google has released **Android 17**, publishing the source code to AOSP under the tag `android-17.0.0_r1` and beginning rollout to supported Pixel devices, with broader availability planned across OEMs including HONOR, Lenovo, OnePlus, OPPO, vivo, Xiaomi, and others. Google also made **Generic System Images** available for `ARM64` and `x86_64`, while the platform adds major usability and device features such as foldable enhancements, App Bubbles, Handoff support, VVC/H.266 video, RAW14, HE-AAC, BLE hearing-aid improvements, and OpenJDK 25 integration. The release introduces a broad set of security and privacy changes, including tighter controls for **contacts**, **location**, and **local network** access, expanded one-time-password handling beyond SMS, stricter restrictions on **dynamic code loading**, stronger lost-device protections, improved threat detection, enhanced **Advanced Protection**, and stricter PIN retry limits. Google also added Certificate Transparency-related enhancements, support for **HPKE** cryptography and **ML-DSA** APK signatures, and continued restrictions on cleartext traffic, alongside Pixel-specific updates delivered through the June Pixel Drop.
Jul 12, 2026
Google has launched a new security feature for Gmail and Google accounts that allows users to designate trusted friends or family members as recovery contacts. This feature is designed to help users regain access to their accounts if they are locked out, for example, due to forgotten passwords, lost passkey devices, or account compromise. Users can select up to 10 trusted contacts, who must accept the request to serve in this role. When a user is locked out, they can initiate the recovery process, which involves sharing a code with their chosen contact. The contact receives a notification and must verify the request by selecting the correct code from a set of options, ensuring that only genuine requests are honored. This process uses number-matching authentication to reduce the risk of social engineering attacks. Google recommends that users choose contacts who are likely to respond quickly, as the recovery request expires after 15 minutes. The company also advises selecting individuals with strong cybersecurity awareness to minimize the risk of exploitation by attackers. The trusted contacts feature is part of Google’s broader push towards passkeys as the future of account authentication, addressing the challenge of device loss that can leave users unable to access their accounts. The recovery process is designed to be secure, with the contact unable to access the user’s account directly, but able to verify the user’s identity. Google Messages will also alert users to spam and help keep texts private, further enhancing account security. The setup process for recovery contacts is straightforward and can be completed on both desktop and mobile devices via the Google account security settings. This new method provides an additional layer of resilience for account recovery, supplementing existing options like email and SMS. The feature aims to reduce the frustration and risk associated with being locked out of critical accounts, especially as more users transition to passwordless authentication. Google’s approach balances convenience with security, leveraging personal trust relationships while maintaining technical safeguards. The company acknowledges that, while unlikely, sophisticated attackers could attempt to exploit the process, so user vigilance remains important. Overall, the trusted contacts feature represents a significant enhancement to Google’s account recovery options, providing users with more reliable and secure ways to regain access to their accounts.
Jun 29, 2026