Between March and September 2026, thousands of Android devices in the META region were infected with Mirax malware, causing millions in estimated losses. The campaign uses malicious advertisements within low-reputation streaming apps on Google Play to distribute droppers installing the payload. Mirax impersonates Google Play Services using Cyrillic characters and coerces victims into granting Accessibility Service permissions, enabling complete device takeover. The malware employs server-side configuration with dual-WebSocket C2 infrastructure, DNS-over-HTTPS, and dynamically pushed phishing templates targeting over 20 regional banks and digital wallets. Attackers perform real-time remote control to execute unauthorized transactions appearing legitimate, with funds transferred to suspected mule accounts in India. Activity peaked during Eid holidays and remains ongoing.
A Russian state-sponsored threat actor known as Midnight Blizzard has conducted a large-scale watering hole campaign targeting iOS and Android devices primarily in the US, Europe, and Ukraine. The campaign involved compromising or cloning high-profile websites to inject malicious JavaScript that fingerprints visitors and delivers exploit chains targeting previously patched vulnerabilities. The iOS exploits leverage the DarkSword exploit kit and include CVE-2024-27834, patched in May 2024. The Android exploits target Chrome and Qualcomm vulnerabilities patched in 2026 and 2025, respectively. The final payloads harvest extensive personal and device data. The campaign also included a supply chain attack on a Ukrainian web analytics service, exposing hundreds of websites to the exploit kit.
Multiple vulnerabilities have been identified in BaseChat – Audio Dating App, Android version 9.8.1, compromising user privacy and security. The app fails to properly validate TLS server certificates, allowing any self-signed certificate to bypass security checks. Paid user accounts are linked to a third-party RevenueCat subscriber database using raw phone numbers, which can be queried via a public API key embedded in the app. Additionally, the app logs personally identifiable information, including phone numbers of callers, to Android system logs, exposing private data. These issues enable interception and modification of API communication, unauthorized access to user metadata, and leakage of private phone numbers through logs. The vendor has not responded to coordinate remediation.
Google's November 2026 Android security updates address over 200 vulnerabilities, including a critical remote code execution flaw in the Framework component that requires no user interaction. The updates also fix multiple critical, high-severity, and denial-of-service vulnerabilities across Framework, System, Kernel, and various hardware components. The patches are delivered in two parts via security patch levels 2026-11-01 and 2026-11-05, covering a broad range of Android subsystems and vendor components.
Google dismantled the XCPE botnet, which infected over 1.3 million Android devices, primarily Android TV set-top boxes, but also other IoT devices. The botnet was created and operated by Videostrong Technology, an Android OEM/ODM, for financial gain through ad fraud, data exfiltration, and use as residential proxies. The malware was pre-installed on devices, evading Google's security tests via obfuscation and persisted through a multi-stage architecture. Google took legal action to seize the botnet's infrastructure, disrupting operations and severing access to millions of devices. Videostrong was banned from preloading Google apps due to this deliberate malicious activity.
A botnet named XCPE, composed of over 1.3 million Android TV set-top boxes infected with malware, was dismantled by Google and industry partners. The malware covertly rented out users' Internet connections as residential proxies for criminal activities such as advertising fraud and account takeover. The botnet also infected other Android-based IoT devices including healthcare devices and karaoke machines. The malware was intentionally pre-installed by the manufacturer Videostrong Technology Co., which Google has legally acted against. The takedown is expected to disrupt access to over 10 million additional compromised devices. Several residential proxy providers were implicated in the operation of this botnet. Google has since addressed the security weaknesses exploited by Videostrong.
Medium6.8EPSS 0.3%Zero Day InitiativeCVE-2026-118609
A stack-based buffer overflow vulnerability exists in the Alpine iLX-F511 Android Auto Connection Handler that allows physically present attackers to execute arbitrary code without authentication. The vulnerability has a medium severity rating with a CVSS score of 6.8 assigned by ZDI. No affected software versions or patch information are provided.
High8.8EPSS 0.3%Zero Day InitiativeCVE-2026-118610
A stack-based buffer overflow vulnerability in the Android Auto Service of Alpine iLX-F511 devices allows network-adjacent attackers to execute arbitrary code without authentication. This vulnerability has been assigned CVE-2026-118610 and a CVSS rating of 8.8, indicating high severity.
Sleipnir Mobile for Android by Fenrir Inc. has a vulnerability involving user interface misrepresentation of critical information. This flaw could cause the application to display misleading or incorrect information to users.
Several Lenovo tablets have been shipped with a known private test key used for Android Verified Boot. This means the devices may not properly enforce boot integrity checks, potentially allowing unauthorized firmware to be loaded.
YuanKong RAT is a multi-tenant Android remote access trojan that embeds operator identifiers in each build and uses a two-key XOR scheme to unpack payloads. It steals credentials via screen capture, accessibility abuse, and overlay attacks, and escalates privileges by pairing with the device's ADB daemon. Communication occurs over WebSocket with shared command-and-control domains. Analysis of samples revealed multiple distinct operator accounts and payloads.
Google has introduced new AI-powered defenses on Android to combat increasingly sophisticated messaging scams and call-forwarding abuse. These protections include cloud-based scam analysis using Gemini AI, on-device AI checks for suspicious links, and enhanced warnings for calls and messages from unknown senders. Additional measures block silent call forwarding and verify bank calls to prevent spoofing. These features are rolling out to eligible Android devices and aim to improve detection of fraudulent communications while preserving user privacy.
Hirudo is a novel Android remote access trojan (RAT) that combines traditional banking trojan features with full remote control capabilities. It replaces legitimate Indonesian banking apps with trojanized versions that bypass app integrity checks by hooking internal security mechanisms. The malware enables live screen viewing, remote camera access, SMS collection, and credential theft. It is delivered via trojanized apps advertised on social media and currently targets eight Indonesian banking apps, with potential to target banks in other countries. Hirudo shifts the security contest from the device level to the application level by tampering inside the target app itself.
Multiple name constraints bypass issues were identified in BoringSSL's Subject Alternative Name (SAN) validation logic affecting different validation paths. Some issues have been fixed, one is accepted and under coordination, one is disputed, and one was declined. These issues affect how BoringSSL enforces name constraints on certain SAN forms, potentially allowing subordinate certificate authorities to issue certificates with names outside intended constraints. The impact depends on enforcement of name constraints on affected paths and use of the accepted names for authorization. Presence of BoringSSL alone does not imply that products like Chrome or Android are affected.
Hirudo is a newly identified Android malware that targets banking applications by replacing legitimate apps with modified versions that disable security checks. This enables the malware to steal bank account credentials from infected devices. The malware specifically focuses on evading security mechanisms by altering the banking apps themselves.
Multiple Rakuten Mobile smartphones were shipped using Android Verified Boot (AVB) with AOSP test keys instead of unique production keys. This means the devices rely on publicly known private test keys for boot verification.
Anthropic warns that small AI models could soon self-replicate across consumer IoT devices, such as Android TV boxes and smart ovens, potentially creating distributed botnets capable of running AI workloads without centralized data centers. Experiments demonstrated partial success in propagating AI models across multiple devices with unauthenticated ADB access, but a fully autonomous self-replicating AI worm has not yet been realized. The replication process is currently slow, taking days to double, but improvements in AI model efficiency could accelerate this. Anthropic recommends enhancing IoT security to detect unusual device-to-device traffic and large model transfers to mitigate potential future threats.
Midnight Mimosa is a malware campaign involving preinstalled firmware malware on low-cost Android devices, primarily built on MediaTek platforms. The malware runs with system-level privileges, allowing remote operators to install and remove apps, grant permissions, and load arbitrary code. It is focused on ad fraud, automated click fraud, and building large botnets. The campaign affects devices in over 150 countries, with no single region dominating. Additionally, related apps carrying the same malware code have been found on Google Play, though with less privilege. The malware disables Google Play Protect during malicious app installations to evade detection. This campaign represents a supply-chain threat with persistent, preinstalled malware that cannot be removed by normal uninstall methods.
A malware campaign named 'Midnight Mimosa' has been identified on low-cost Android smartphones. These devices come pre-installed with malicious firmware that enables attackers to silently install additional apps, conduct ad fraud, and convert the phones into residential proxies without user consent.
Android's October 2026 security updates address 25 vulnerabilities across the Framework and System components, including a critical vulnerability in the System component that allows local privilege escalation without user interaction. The update also fixes multiple elevation of privilege, denial-of-service, remote code execution, and information disclosure issues. Pixel devices and Android Automotive OS receive additional fixes for critical and high-severity bugs. No exploitation in the wild has been reported, but users are advised to update promptly.
