Loading story…
Independent research found systemic privacy gaps in Chinese smart home iOS apps, particularly around bystander privacy (people captured by cameras/mics who are not the account owner). A review of 49 apps in Apple’s mainland China App Store reported frequent mismatches between App Store privacy labels, privacy policies, and in-app settings, alongside broad collection of sensitive data and permissions (e.g., location, camera, microphone, contacts, Bluetooth, notifications) and identity-linked registration requirements (phone number + SMS verification).
Separately, a technical proof-of-concept demonstrated how Android’s AccessibilityService can be abused as a “single-toggle” path to near-total device control without rooting or exploiting a vulnerability. The write-up describes rapid, silent enablement/abuse patterns that can lead to permission-like capabilities (screen capture, keylogging, gesture injection, data access, and remote control via a browser-based C2), highlighting how this legitimate accessibility feature is leveraged by stalkerware/monitoring ecosystems and why existing coverage often understates the practical impact.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
The study reported that Apple privacy labels often underreported tracking and user-linked data collection, and that disclosures about law-enforcement or public-security data sharing lacked corresponding user notification features. Researchers recommended stronger bystander-focused controls and better transparency.
A research study reviewed 49 smart home apps in Apple’s App Store in mainland China and found that protections for bystanders were largely absent. The analysis identified broad sensitive data collection and recurring inconsistencies between privacy policies, in-app controls, and App Store privacy labels.
The same research described a pivot in which an app targeting SDK 28 can execute binaries from its app data directory, download a Termux-compatible Linux userland, and run tools such as nmap, python, and openssh inside the app sandbox with only INTERNET permission. The author framed this as a design-level Android platform risk that supports commercial stalkerware-style abuse.
A blog post described a proof-of-concept Android implant that can achieve near-total device control after a user enables a malicious app’s AccessibilityService, without root, exploits, or zero-days. The author said the PoC used documented Android APIs to support capabilities such as permission granting, contextual keylogging, remote touch control, screenshot capture, stealth overlays, and persistence techniques.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcechocapikk.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recent large-scale analysis of 50,000 mobile applications has revealed that over 77% of these apps leak personally identifiable information due to insecure data handling and insufficient privacy controls. The study found that many iOS applications fail to include required privacy manifests, while Android apps often circumvent explicit data-safety disclosures, creating significant blind spots in user privacy protections. These vulnerabilities are particularly concerning given the central role mobile devices play in daily communications and financial transactions, making users susceptible to tracking, profiling, and data theft. The research underscores the systemic nature of privacy risks in the mobile app ecosystem, with both platforms exhibiting gaps in transparency and compliance. In parallel, regulatory efforts to protect minors online are introducing new privacy challenges, as exemplified by Texas's SB 2420 law, which mandates age assurance for app store users and developers. Apple has voiced strong concerns that such laws require the collection and storage of sensitive personal information, such as government IDs, even for benign app downloads, thereby increasing the risk of data breaches. Starting January 1, 2026, Apple will require new account holders to confirm they are over 18, and minors will need parental consent for app downloads and purchases, further expanding the amount of sensitive data collected. Apple argues that these requirements should be limited to apps where age verification is truly necessary, warning that blanket mandates could have unintended privacy consequences. The complexity is heightened by the patchwork of state-level laws, with similar regulations set to take effect in Utah and Louisiana, compelling developers to adapt to varying compliance standards. The risks of such data collection are not theoretical; a recent breach at a third-party provider for Discord, which handled age verification, resulted in the exposure of sensitive government ID images. This incident illustrates the tangible dangers of accumulating large repositories of personal data for regulatory compliance. The convergence of insecure app data practices and regulatory-driven data collection amplifies the threat landscape for mobile users. Both industry and regulators face the challenge of balancing user safety, especially for minors, with the imperative to minimize unnecessary data exposure. The findings highlight the urgent need for stronger privacy-by-design principles in app development and more nuanced regulatory approaches that do not inadvertently increase user risk. As mobile platforms continue to evolve, ongoing vigilance and collaboration between stakeholders will be essential to safeguard user privacy. The situation calls for immediate action from app developers, platform providers, and policymakers to address these multifaceted privacy threats. Users are advised to remain cautious about the permissions they grant and the information they share with mobile applications. The broader industry must prioritize transparency, user control, and robust security measures to restore trust in the mobile app ecosystem.
Jun 29, 2026
Researchers have uncovered significant security and privacy issues in Android mobile applications, particularly those in the healthcare sector. A comprehensive study analyzed 272 healthcare-related Android apps, revealing that many transmit sensitive user data without encryption, store files insecurely, or share information with third-party components without adequate safeguards. The research team employed multiple static analysis tools, including MobSF, RiskInDroid, and OWASP Mobile Audit, to assess the security posture of these apps. MobSF identified weaknesses in permissions, network handling, certificate management, and manifest configuration, with app security scores ranging from 35 to 60 out of 100. RiskInDroid found that 150 apps used undeclared permissions, potentially creating hidden channels for data exfiltration, and flagged proprietary permissions that could bypass standard Android security controls. The OWASP Mobile Audit of 95 apps detected issues such as unencrypted local storage, hardcoded credentials, and missing input validation, mapping these weaknesses to the OWASP Mobile Top 10 categories. In parallel, researchers have demonstrated that some Android apps can bypass operating system permissions to access sensitive data through hidden methods and side-channel attacks. One such attack, dubbed 'Pixnapping' and tracked as CVE-2025-48561, allows a malicious app to capture screen display pixels, potentially exposing sensitive information like two-factor authentication codes. The Pixnapping attack was demonstrated on multiple devices, including Google Pixel 6 through 9 and Samsung Galaxy S25, and is conceptually similar to a 12-year-old browser-based data-stealing technique. Despite previous attempts by Google to address this vulnerability, researchers showed that the flaw remains exploitable on Android versions 13 to 16. The ability of apps to sidestep permissions and leverage hardware side channels raises serious concerns about the effectiveness of current Android security controls. These findings highlight the urgent need for stronger app vetting processes, improved permission management, and enhanced user awareness regarding the risks of installing mobile applications. The exposure of sensitive healthcare data is particularly alarming, given the potential for identity theft, fraud, and privacy violations. Security experts recommend that users exercise caution when granting permissions to apps and that developers adhere to best practices for secure coding and data protection. The research underscores the importance of regular security assessments and updates to address emerging threats in the mobile ecosystem. Industry standards such as the OWASP Mobile Top 10 provide a useful framework for identifying and mitigating common vulnerabilities. The ongoing discovery of new attack vectors, such as Pixnapping, demonstrates that attackers continue to innovate, necessitating a proactive and layered approach to mobile security. Organizations handling sensitive data, especially in healthcare, must prioritize mobile app security to protect user privacy and comply with regulatory requirements. The convergence of insecure app design and advanced attack techniques poses a growing threat to the confidentiality and integrity of user data on Android devices.
Jun 29, 2026
Researchers linked **Earth Empusa**—also tracked as **POISON CARP** and **Evil Eye**—to a sustained mobile espionage campaign targeting people connected to **Uyghur, Tibetan, Turkish, and Taiwanese communities**. The group used phishing messages, fake download pages, and compromised websites to deliver malware and profile victims, including an Android spyware family dubbed **ActionSpy** that impersonated the legitimate Uyghur video app **Ekran**. Trend Micro said the malware harvested device details, location, files, audio, screenshots, and camera images, and abused Android Accessibility services to steal chat content from apps including **WeChat, QQ, WhatsApp, and Viber**. The same activity overlapped with earlier reporting on large-scale surveillance of Uyghurs and with in-the-wild **iOS** watering-hole attacks documented by Google Project Zero and Google TAG. In that campaign, visitors to hacked websites were hit with multiple exploit chains spanning nearly all supported **iOS 10–12** versions, enabling installation of implants that stole **iMessages, photos, and GPS data** in real time. Google identified **14 vulnerabilities** across the chains, including browser, kernel, and sandbox-escape flaws, and Apple issued **iOS 12.1.4** after being notified, underscoring the breadth of a multi-year operation aimed at monitoring targeted communities across both Android and iPhone devices.
Aug 15, 2026