The Android application "Ticket Ryutsu Center" by Wavedash Co., Ltd. contains multiple unspecified vulnerabilities. No detailed technical information, affected versions, or exploit data are provided.
This report summarizes multiple cybersecurity developments including a set of iCloud email spoofing vulnerabilities, phishing campaigns targeting AI policy experts, a Chrome adblocker extension spying on AI chat conversations, and a large batch of vulnerabilities patched by Kiteworks. The iCloud spoofing bugs allowed attackers to send emails from arbitrary icloud.com addresses that passed SPF, DKIM, and DMARC checks due to inconsistent mail header parsing. The phishing campaigns involved a China-aligned group using fake AI advisory committee invitations to steal credentials via an adversary-in-the-middle proxy. The Poper Blocker Chrome extension was found to collect users' browsing history and AI chat conversations stealthily. Kiteworks patched over 100 vulnerabilities, including critical bugs that could lead to account takeover and code execution. Additional highlights include AI-assisted discovery of Android app flaws and a Cloudflare Containers data leakage vulnerability that was patched. No active exploits in the wild were reported for these issues.
Signal has released version 8.30, completing the rollout of its secure backups feature across all supported platforms including iOS and desktop apps. This feature allows users to create end-to-end encrypted backups of their chats, either hosted by Signal or stored locally on the device. The backups require a recovery key for decryption, and hosted backups include an additional rotating key for enhanced security. The update introduces local encrypted backups to iOS and desktop, aligns Android backups to a cross-platform format, and improves media storage efficiency. The backup system excludes disappearing messages set to vanish within 24 hours. The new iOS client also supports direct encrypted iPhone-to-iPhone transfers via Wi-Fi Aware. This release marks the completion of Signal's first phase of its backups project.
Readwise Reader for Android version 8.7.2 contains three stored cross-site scripting (XSS) vulnerabilities. These flaws allow attackers who can supply malicious documents or metadata to execute arbitrary JavaScript within the app's WebView context. The vulnerabilities arise from insufficient sanitization of document metadata fields, improper escaping of URL metadata, and permissive sanitization rules for SVG markup. Exploitation could compromise user data confidentiality and integrity, including access to stored documents, credentials, and session tokens. A patch addressing one of the issues is available in version 8.10.1. Users are advised to update when possible and exercise caution when adding content from untrusted sources.
Researchers demonstrated that file-change notification systems in Windows, Linux, Android, and macOS can be exploited to leak user activity such as keystroke timing, browsing habits, and media events without elevated privileges. The attacks rely on monitoring file system events accessible to unprivileged users or apps, revealing metadata like file names and event timing rather than file contents. On Windows, monitoring the system drive root can expose file paths in other users' profiles, enabling website fingerprinting. Linux kernel mitigations partially address the most severe issues, but no patches exist for Android or macOS. Microsoft considers the behavior by design and not a vulnerability. No in-the-wild exploitation is known, and proof-of-concept code is publicly available.
ViewSonic vCast software, used in ViewBoard smartboards, contains multiple unauthenticated vulnerabilities that can be chained by a remote attacker with network access to fully compromise the device. These include screen content exfiltration via unauthenticated API endpoints, unprivileged APK installation through an unauthenticated download endpoint, and arbitrary input injection via exposed network services. No vendor fix is currently available. Interim mitigations include network segmentation and monitoring.
A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. [...]
RatHat is an Android trojan that uses generative AI to automate real-time device navigation and control, enhancing its adaptability and evasion capabilities. It steals credentials, mimics banking apps, intercepts SMS, and gains administrator-level permissions. The malware persists by reinstalling itself if removed and uses advanced keylogging techniques, including hardware-level monitoring of user input. It communicates with a command-and-control server via a secure reverse tunnel and abuses Android debugging tools for system-level access. RatHat is distributed through smishing and malvertising and appears linked to a Chinese threat actor.
RatHat is a newly discovered Android malware that leverages AI to automate remote control of infected devices. It abuses Android Accessibility permissions to perform privileged actions, including enabling Developer Options and Wireless Debugging to gain shell-level access without external devices. RatHat installs a persistent Go-based agent that manages execution, persistence, and restoration of the malware and its components. It captures sensitive information such as banking credentials, SMS messages, one-time passwords, and lock-screen PINs via overlays and keylogging. The AI subsystem enables adaptive interface navigation by analyzing the live Accessibility tree and issuing dynamic commands, making detection and removal more difficult. The malware also employs anti-analysis and anti-removal techniques, including fake uninstall screens and obfuscation methods. Distribution occurs through malvertising, SMS, and phishing sites promoting APKs outside Google Play.
Google released the September 2026 security patches for Pixel devices addressing 110 vulnerabilities, including one zero-day flaw that was actively exploited in targeted attacks. The update mitigates this actively exploited vulnerability to protect affected devices.
The Android application "ManabiPocket for Parents" by NTT DOCOMO BUSINESS, Inc. has an improper access control vulnerability. This issue could allow unauthorized access to certain application functions or data due to insufficient access restrictions. No specific affected versions or technical details are provided, and no known exploits are reported. Patch or remediation status is not confirmed.
The Android application "YAMAP -Social Trekking GPS App" by YAMAP INC. has an improper access control vulnerability in its WebView component. This flaw could potentially allow unauthorized access to certain app functionalities or data due to insufficient access restrictions in the WebView implementation.
Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes. [...]
Mantax Otax is a newly identified Android malware strain that combines ransomware and spyware functionalities. It encrypts files on infected devices, steals sensitive user data, and additionally spams and harasses victims. This multifaceted malware poses a significant threat to Android users by compromising both data confidentiality and user experience.
Deceptive Android apps are exploiting Google Play's Early Access program to evade public reviews and ratings. Dishonest developers advertise these apps externally, promising rewards that never materialize, while the apps primarily serve aggressive advertisements. These apps often impersonate legitimate games or use trademark abuse and AI-generated misleading content. Although not delivering malware or clearly illegal content, this misuse harms users by wasting their time and exposing them to excessive ads.
Mantax Otax is an Android malware targeting devices running Android 9 and earlier. It combines ransomware and spyware capabilities, encrypting files with AES and appending .enc extensions. The malware requests extensive permissions, including device administrator and accessibility access, to steal sensitive data such as screen recordings, browser history, PINs, contacts, call logs, SMS, and chats from WhatsApp and Telegram. It communicates with command and control servers via HTTPS and WebSockets, using dynamic domain resolution through GitHub. Version 2 introduces advanced features like UI hijacking, screen blocking, touch input interception, harassment capabilities, and remote text-to-speech. Data exfiltration is facilitated through Firebase and Catbox services, enabling a double-extortion scheme with an interactive ransom chat portal.
The September 2026 Android security updates address 180 vulnerabilities across the Framework, System, and Kernel components. The most critical issues include remote code execution flaws in the System component that require no user interaction or additional privileges. The updates are delivered in two parts, covering a wide range of Android runtime, Framework, System, and kernel components, as well as various chipset vendors. No specific patches were released this month for Wear OS, Android XR, or Android Automotive OS, but their updates include these fixes. The updates are critical for maintaining device security and preventing potential remote exploitation.
StreamRat is an Android banking trojan distributed via Meta and TikTok ads disguised as a free TV-streaming app targeting Spanish-speaking users, mainly in Spain. It uses a two-stage installation with a dropper that disables internet connectivity through fake VPN connections. After installation, it abuses Accessibility Services and the MediaProjection API to grant attackers near-complete control over the device, including VNC remote control, hidden screen manipulation, keylogging, credential-stealing overlays, UI data collection, and screen blocking. The malware operates as a Malware-as-a-Service with a multi-role control panel and WebSocket-based command and control communications. The campaign potentially affected around 570,000 users. No official patch or remediation guidance is currently available.
Manic is a newly discovered Android malware family that steals banking credentials, intercepts sensitive data, and allows remote control of infected devices. It uniquely exfiltrates stolen data even without an internet connection by exploiting Android Accessibility services to capture keystrokes and replay them on targeted apps. The malware targets banking apps, government apps, crypto wallets, and two-factor authentication apps across multiple European countries. Infection vectors likely include unofficial app stores, malicious APKs, and phishing links, with no evidence of distribution via Google Play. Manic abuses Accessibility permissions to spy on users, grant itself additional permissions, and prevent removal. It overlays an invisible keyboard to capture passwords and sensitive input. The malware has been active since at least May 2026 and continues to evolve to evade detection.
Android 17 introduces Encrypted Client Hello (ECH) support to enhance user privacy by encrypting the hostname in TLS handshakes, preventing network observers from easily seeing visited websites. This platform-level integration works with compatible apps and browsers, such as Chrome 117+ and Firefox 119+, to obscure domain names from ISPs and Wi-Fi operators. Additional network protections include requiring app permissions for local network scanning, enabling Certificate Transparency by default, and allowing mobile operators to disable 2G to reduce exposure to certain attacks.
