Loading story…
Security researchers Daniel Wegemer and Edoardo Mantovani have reverse engineered MediaTek Wi-Fi chip firmware, revealing hidden modes that enable advanced access to wireless signals. Their work allows monitor mode, previously limited to notebooks, to be enabled on smartphones, expanding research and security testing capabilities. The findings also provide methods for analyzing embedded architectures and could facilitate new applications such as motion detection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MediaTek disclosed two high-severity modem vulnerabilities, **CVE-2026-20432** and **CVE-2026-20433**, that stem from out-of-bounds writes caused by missing bounds checks in affected modem components. The flaws can allow **remote privilege escalation** when a user equipment device connects to a **rogue base station** controlled by an attacker, potentially exposing confidentiality, integrity, and availability to high impact. Both issues are classified as `CWE-787` and carry severe CVSS v3.1 ratings, with vectors `AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` for CVE-2026-20432 and `AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` for CVE-2026-20433. The vulnerabilities were published through MediaTek’s April 2026 product security bulletin and tracked internally as **MSV-4461** and **MSV-4460**. MediaTek linked the issues to patch identifiers **MOLY01406170** for CVE-2026-20432 and **MOLY01088681** for CVE-2026-20433, indicating that remediation is available for impacted products. Organizations using Huawei devices or other equipment built on affected MediaTek modem components should prioritize vendor patch validation and assess exposure to baseband-level attacks involving malicious cellular infrastructure.
Jun 29, 2026
Security researchers have demonstrated new hardware-based techniques to extract sensitive data from devices previously considered secure, including smartwatches and confidential computing servers. In one case, analysts revived the 'Blinkenlights' technique, adapting it to modern TFT screens to extract firmware from a budget smartwatch by exploiting a dial parser vulnerability. This allowed arbitrary memory content to be displayed on the device's screen, which was then captured using a high-speed Raspberry Pi Pico setup. The smartwatch, which contained fake health sensors and used a JieLi AC6958C6 system-on-chip, was found to have weak authentication and a flawed firmware parser, enabling the out-of-bounds read attack. Separately, researchers from KU Leuven University presented a low-cost hardware attack called 'Battering RAM' at Black Hat Europe 2025, which targets secure CPU enclaves such as Intel SGX and AMD SEV. By using a $50 DDR4 interposer, the researchers manipulated memory address mapping at runtime, bypassing firmware mitigations and gaining unauthorized access to encrypted memory. This allowed them to extract platform provisioning keys, forge attestation reports, and implant persistent backdoors on protected virtual machines, raising concerns about the security of cloud infrastructures relying on these technologies.
Jun 29, 2026
Security researchers and vendors reported **hardware/firmware-level vulnerabilities in Android chip components** that can enable deep device compromise beyond typical app-layer defenses. Ledger’s Donjon research described a flaw involving **MediaTek chip boot-chain behavior and Trustonic’s trusted execution environment (TEE)** that allowed rapid physical compromise: by connecting an affected phone to a laptop over **USB**, attackers could allegedly brute-force the PIN, decrypt storage, and extract sensitive data including messages and **cryptocurrency wallet seed phrases** (e.g., Kraken Wallet, Phantom). The researchers estimated the affected MediaTek chips appear in roughly **one-quarter of Android phones**, disproportionately in lower-cost devices. Separately, Zimperium reported active exploitation of a **Qualcomm graphics zero-day** (**CVE-2026-21385**) in targeted Android attacks, describing a memory-corruption condition that could enable code execution or unauthorized access across “hundreds” of Qualcomm chipsets. A ZDNET article on Android’s *Repair Mode* primarily provides user guidance and anecdotal troubleshooting around a buggy March update/SIM recognition issue; it does not substantively address the chip-level vulnerabilities described in the other reporting and is best treated as tangential consumer advice rather than incident or vulnerability intelligence.
Jun 29, 2026