Loading story…
Jamf Threat Labs identified two mobile apps leaking user credentials and PII over unencrypted HTTP. The affected apps are from a Malaysian healthcare platform and an Indian jewelry company, with the iOS version of the latter and both versions of the former at risk. Developers were notified but did not respond, prompting public disclosure after the responsible disclosure period expired.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
4 references tracked. Mallory keeps watching after this page renders.
zimperium.com
Open sourcescworld.com
Open sourcezimperium.com
Open sourcejamf.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Wake Forest University found widespread credential leakage in AI-enabled iOS apps, reporting that **282 of 444** tested applications exposed exploitable access to LLM services or supporting backends during normal use. The affected apps spanned 13 categories, including productivity, education, utilities, entertainment, lifestyle, and health and fitness, and included both niche titles and highly popular apps with millions of ratings. The exposed data created opportunities for attackers to abuse developers’ LLM accounts, consume cloud resources, and access backend services. The study identified three recurring failure patterns: plaintext API keys sent directly to LLM providers, unauthenticated backend proxy endpoints, and replayable JWT bearer tokens with weak or broken expiration controls. Researchers said many apps lacked effective protections against traffic interception, and common defenses could be bypassed through VPN-based transparent capture. After responsible disclosure and a 90-day retest, remediation remained limited: about **28%** of vulnerable apps had fixed the issues, while dozens remained exploitable because developers made little change or relied on fundamentally flawed authentication designs.
Jul 12, 2026
Researchers have uncovered significant security and privacy issues in Android mobile applications, particularly those in the healthcare sector. A comprehensive study analyzed 272 healthcare-related Android apps, revealing that many transmit sensitive user data without encryption, store files insecurely, or share information with third-party components without adequate safeguards. The research team employed multiple static analysis tools, including MobSF, RiskInDroid, and OWASP Mobile Audit, to assess the security posture of these apps. MobSF identified weaknesses in permissions, network handling, certificate management, and manifest configuration, with app security scores ranging from 35 to 60 out of 100. RiskInDroid found that 150 apps used undeclared permissions, potentially creating hidden channels for data exfiltration, and flagged proprietary permissions that could bypass standard Android security controls. The OWASP Mobile Audit of 95 apps detected issues such as unencrypted local storage, hardcoded credentials, and missing input validation, mapping these weaknesses to the OWASP Mobile Top 10 categories. In parallel, researchers have demonstrated that some Android apps can bypass operating system permissions to access sensitive data through hidden methods and side-channel attacks. One such attack, dubbed 'Pixnapping' and tracked as CVE-2025-48561, allows a malicious app to capture screen display pixels, potentially exposing sensitive information like two-factor authentication codes. The Pixnapping attack was demonstrated on multiple devices, including Google Pixel 6 through 9 and Samsung Galaxy S25, and is conceptually similar to a 12-year-old browser-based data-stealing technique. Despite previous attempts by Google to address this vulnerability, researchers showed that the flaw remains exploitable on Android versions 13 to 16. The ability of apps to sidestep permissions and leverage hardware side channels raises serious concerns about the effectiveness of current Android security controls. These findings highlight the urgent need for stronger app vetting processes, improved permission management, and enhanced user awareness regarding the risks of installing mobile applications. The exposure of sensitive healthcare data is particularly alarming, given the potential for identity theft, fraud, and privacy violations. Security experts recommend that users exercise caution when granting permissions to apps and that developers adhere to best practices for secure coding and data protection. The research underscores the importance of regular security assessments and updates to address emerging threats in the mobile ecosystem. Industry standards such as the OWASP Mobile Top 10 provide a useful framework for identifying and mitigating common vulnerabilities. The ongoing discovery of new attack vectors, such as Pixnapping, demonstrates that attackers continue to innovate, necessitating a proactive and layered approach to mobile security. Organizations handling sensitive data, especially in healthcare, must prioritize mobile app security to protect user privacy and comply with regulatory requirements. The convergence of insecure app design and advanced attack techniques poses a growing threat to the confidentiality and integrity of user data on Android devices.
Jun 29, 2026
Practice by Numbers remediated an access-control flaw in its dental patient portal after a patient discovered that changing sequential document numbers in the URL let any authenticated user view other patients’ files. The exposed records included private health information, medical histories, personal details, and photo identification. After difficulties reporting the issue through the company’s broken or missing security contact channels, TechCrunch alerted the vendor, which took the portal offline, fixed the bug, and restored service. Practice by Numbers said server logs indicate fewer than 10 patients were affected, that it found no evidence of earlier exploitation, and that it is notifying the impacted dental practice. In a separate privacy exposure, researcher Jeremiah Fowler found a publicly accessible, passwordless database containing 86,859 private images, screenshots, and messages linked to a high-profile European celebrity and several social media influencers. The leaked material included chats from WhatsApp, Facebook, TikTok, and Instagram, along with phone numbers, email addresses, invoices, receipts, and identity-related documents. Fowler said the screenshots appeared to have been captured from victims’ phones, pointing to suspected stalkerware activity before the data was exposed through a misconfigured server, and he notified affected individuals and law enforcement while withholding names to limit further harm.
Jun 29, 2026