43932
Mobile cybersecurity channel Links: https://linktr.ee/mobilehacker Contact: mobilehackerofficial@gmail.com
apk-info: APK full-featured parser
https://github.com/delvinru/apk-info
Morpheus: A new Spyware linked to IPS Intelligence
https://osservatorionessuno.org/blog/2026/04/morpheus-a-new-spyware-linked-to-ips-intelligence/
New NGate variant hides in a trojanized NFC payment app
https://www.welivesecurity.com/en/eset-research/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app/
MiningDropper – A Global Modular Android Malware Campaign Operating at Scale
https://cyble.com/blog/miningdropper-global-modular-android-malware/
Android Bankers: 4 Campaigns In A Row
https://zimperium.com/blog/android-bankers-4-campaigns-in-a-row
Reversing XAMARIN Mobile Applications
https://mrbypass.medium.com/reversing-xamarin-mobile-applications-3910a857444d
Giving an Agent a Rooted Android Phone
https://workers.io/blog/autonomous-mobile-pentesting/
Intent redirection vulnerability in third-party EngageLab SDK exposed millions of Android wallets to potential risk
https://www.microsoft.com/en-us/security/blog/2026/04/09/intent-redirection-vulnerability-third-party-sdk-android/
Canis C2 Exposed: Previously Undocumented Cross-Platform Surveillance Framework Targeting Japan pivoting from Android sample
https://hunt.io/blog/canis-c2-exposed-cross-platform-surveillance-framework-japan
Analysis of cifrat: could this be an evolution of a mobile RAT?
https://cert.pl/en/posts/2026/04/cifrat-analysis/
Analysis of Android FvncBot banker campaign targeting Polish users
https://cert.pl/en/posts/2026/03/fvncbot-analysis/
Microsoft Authenticator’s Unclaimed Deep Link: A Full Account Takeover Story (CVE-2026–26123)
https://khaledsec.medium.com/microsoft-authenticators-unclaimed-deep-link-a-full-account-takeover-story-cve-2026-26123-e0409a920a02?sk=df506976e7c2d15fd29e70725873f6e2
Decompiling an Android Application Written in .NET MAUI 9 (Xamarin)
https://mwalkowski.com/post/decompiling-an-android-application-written-in-net-maui-9-xamarin/
The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors
https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/
Weaponizing LSPosed: Remote SMS Injection and Identity Spoofing in Modern Payment Ecosystems
https://www.cloudsek.com/blog/weaponizing-lsposed-remote-sms-injection-and-identity-spoofing-in-modern-payment-ecosystems-2
KYCShadow: An Android Banking Malware Exploiting Fake KYC Workflows for Credential and OTP Theft
https://www.cyfirma.com/research/kycshadow-an-android-banking-malware-exploiting-fake-kyc-workflows-for-credential-and-otp-theft/
Bad Connection: Uncovering how global mobile networks themselves have become surveillance infrastructure to spy on location of targets
https://citizenlab.ca/research/uncovering-global-telecom-exploitation-by-covert-surveillance-actors/
FakeWallet crypto stealer spreading through iOS apps in the App Store
https://securelist.com/fakewallet-cryptostealer-ios-app-store/119474/
Lorikazz: An Android TV and STB botnet using Tor .onion C2, ENS resolution, and bundled ELF payloads disguised as system libraries to hijack set-top boxes for proxyware operations
https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-04-13-LORIKAZZ-ANDROID-IOT.txt
MalFixer: toolkit for inspecting and recovering malformed Android APK files (repairs corrupted ZIP entries, decodes and reconstructs malformed Android manifests, and extracts or sanitises problematic asset files)
https://github.com/Cleafy/Malfixer
Pre-installed C2 Infrastructure and RAT Payload on Android Projectors
https://github.com/Kavan00/Android-Projector-C2-Malware
Mirax: a new Android RAT turning infected devices into potential residential proxy nodes
https://www.cleafy.com/cleafy-labs/mirax-a-new-android-rat-turning-infected-devices-into-potential-residential-proxy-nodes
Hack-For-Hire Operation Linked to BITTER APT (Android ProSpy spyware)
https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire
PoC of DarkSword iOS exploit tested on iOS 17.1.1 - 26.0.1
https://github.com/rooootdev/lara
Operation NoVoice: Rootkit Tells No Tales (link to Android Triada family)
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/new-research-operation-novoice-rootkit-malware-android/
Coruna: the framework used in Operation Triangulation
https://securelist.com/coruna-framework-updated-operation-triangulation-exploit/119228/
SSL pinning bypass setup for iOS (No Jailbreak) using OpenVPN + iptables traffic redirection to proxy (Burp Suite / mitmproxy)
https://github.com/SahilH4ck4you/iOS-SSL-pinning-bypass-without-jalibreak
Perseus: DTO malware that takes notes
https://www.threatfabric.com/blogs/perseus-dto-malware-that-takes-notes
Oblivion RAT - An Android Spyware Platform With a Built-In APK Factory
https://iverify.io/blog/oblivion-rat-android-spyware-analysis
Taking Apart iOS Apps: Anti-Debugging and Anti-Tampering in the Wild
https://blog.calif.io/p/taking-apart-ios-apps-anti-debugging