Android

The Attendo Admin Android application version 3.0.13 and earlier contains hard-coded MQTT credentials in bundled configuration files, allowing unauthorized access to production data and potential message injection.

Google disrupted a botnet of over 1.3 million Android devices, including TV set-top boxes, found to contain a persistent firmware-level backdoor intentionally installed by manufacturer Videostrong.

The activity.LoadLinkLaterActivity component in Handy News Reader versionCode 116 contains a vulnerability that allows attackers to force the application to fetch arbitrary crafted URLs.

A public Proof of Concept has been released for CVE-2025-0098, an activity token leak vulnerability in the Android framework allowing arbitrary startActivity() calls due to insufficient process identifier validation.

CVE-2025-21479 is a high-severity local privilege escalation vulnerability in the Qualcomm Adreno GPU driver allowing for kernel-level arbitrary physical memory writes, with functional exploits now targeting Android devices including the iQOO Neo9.

The A2A Java SDK for Android fails to properly disable HTTP redirects in synchronous POST requests, allowing sensitive authentication tokens to be leaked to unauthorized authorities following a 302 redirect.

A heap-based buffer overflow in the media.swcodec component of Google Android 16.0 allows for remote code execution via a ROP chain triggered by a maliciously crafted video file.

A publicly available exploit for CVE-2026-98256 enables local privilege escalation on Android/ARM64 systems by leveraging a race condition in the InfinityCore Signal subsystem to gain a root shell.

A local privilege escalation vulnerability (CVE-2026-80775) in the InfinityCore Android kernel allows attackers to achieve root access via a race condition in the Futex subsystem.

CVE-2026-98385 is a local privilege escalation vulnerability in the InfinityCore Android scheduler stemming from a use-after-free condition in per-CPU cache statistics, allowing attackers to overwrite task credentials.

CVE-2026-0023 allows a malicious installer to suppress security warnings by manipulating internal installation flags, potentially facilitating the installation of malicious updates for legitimate applications.

The Midnight Mimosa campaign utilizes platform-signed, pre-installed malware on low-cost MediaTek Android devices to execute ad fraud, click fraud, and residential-proxy botnet enrollment.

An improperly exported MiracastService component on Android TV devices using MediaTek chipsets allows local attackers to manipulate Wi-Fi Direct states and cause denial of service via a confused deputy attack.

A local improper authorization vulnerability in the Lenovo File Manager Android app allows authenticated local users to read or modify protected application files.

Chinese-speaking threat actors are using the AppPanda phishing platform to distribute the PanDa Android RAT via Meta Ads, targeting Spanish-speaking users in Mexico to harvest banking credentials.

CVE-2019-6447 allows unauthenticated attackers on a local Wi-Fi network to execute arbitrary commands and exfiltrate files from Android devices running vulnerable versions of ES File Explorer.

Threat actors are actively exploiting vulnerabilities in Android-based automotive head units to install malicious software that enrolls the devices into a residential proxy botnet.

A public proof-of-concept deployment script for CVE-2024-31317 enables local privilege escalation and arbitrary code execution on Android 9 through 13 by exploiting Zygote process command injection via the global settings API.

Kimwolf v7 is an evolved Android/IoT botnet that leverages unauthenticated ADB access, Ethereum Name Service (ENS) resolution, and HTTP/2 browser fingerprinting to perform resilient DDoS operations.

The proot-distro package fails to validate container boundaries during the restoration of archive files, allowing attackers to perform cross-container file disclosure and injection.

Russian state-sponsored threat actor UAC-0145 (Sandworm sub-cluster) is actively targeting Ukrainian organizations by using fake ClickFix CAPTCHAs on compromised websites to trick users into executing malicious PowerShell commands, leading to the deployment of data-stealing malware on Windows and Android devices.

A public exploit has been published for CVE-2026-43499, a Use-After-Free vulnerability in the Linux Kernel, demonstrated to achieve KASLR bypass and potential privilege escalation on Android 15 devices running Linux Kernel 5.15.149, significantly elevating risk for unpatched systems.

CERT-FR has disclosed 31 vulnerabilities in various Microsoft Office products, including CVE-2026-44803 and CVE-2026-47635, which could allow remote code execution, privilege escalation, and data confidentiality compromise.

An integer overflow vulnerability (CVE-2025-48595) in the Android Framework allows for local code execution, potentially leading to privilege escalation on affected Android devices by a locally present attacker.

BTMOB is a Malware-as-a-Service (MaaS) Android RAT, first observed in February 2025, that uses phishing lures and the abuse of Android Accessibility Services to gain control of devices for data exfiltration, screen capture, and remote access.

The Motorola Factory Test component (com.motorola.motocit) contains an improper authentication vulnerability, allowing a local attacker to bypass permission checks and access protected device settings by leveraging a writable file descriptor in external storage to open a TCP server.

The Q1 2026 mobile threat landscape saw a decrease in overall attack volume driven by reduced adware and RiskTool detections, while the number of unique users targeted remained stable, with new SparkCat variants on app stores and increased banking Trojan and Triada backdoor activity.

A zero-click exploit chain was developed for the Google Pixel 10, achieving root access on Android by exploiting a patched Dolby vulnerability (CVE-2025-54957) and a memory mapping vulnerability in the Chips&Media Wave677DV video processing unit (VPU) driver.

ESET researchers discovered 28 fraudulent Android apps, named CallPhantom, on Google Play that falsely claim to provide call logs for any phone number in exchange for payment, generating random data or requesting email addresses and amassing over 7.3 million downloads before being removed.

The ScarCruft APT group conducted a supply-chain attack targeting the Yanbian region by compromising a gaming platform, sqgame, used by ethnic Koreans, trojanizing Windows and Android games with the BirdCall backdoor for espionage activities since late 2024.

A vulnerability in Google Android allows an attacker from a neighboring network to execute arbitrary code with administrator privileges, potentially leading to complete device compromise.

The APT37 group (ScarCruft) is distributing an Android version of the BirdCall backdoor via a supply-chain attack targeting a Chinese video game platform, sqgame[.]net, to collect sensitive information from users.

A vulnerability in Google Android allows a remote attacker to execute arbitrary code, affecting versions prior to 14, 15, 16 and 16-qpr2 before the May 4, 2026 patch.

A path traversal vulnerability in Apktool versions 3.0.0 and 3.0.1 allows a malicious APK file to write arbitrary files to the filesystem during decoding, potentially leading to remote code execution.

Mirax RAT, a new Android RAT distributed as MaaS, is targeting European users by turning infected devices into residential proxy nodes and enabling credential theft via overlay and notification injection.

OpenClaw before 2026.3.22 is vulnerable to arbitrary code execution due to an unvalidated WebView JavascriptInterface, allowing attackers to inject malicious instructions by invoking the canvas bridge from untrusted pages.

A missing release of memory vulnerability (CVE-2026-33852) in MolotovCherry Android-ImageMagick7 before version 7.1.2-11 can lead to a denial-of-service condition due to memory exhaustion.

An unauthenticated, remote attacker can exploit an out-of-bounds write vulnerability (CVE-2026-33854) in MolotovCherry Android-ImageMagick7 versions before 7.1.2-10 by enticing a user to open a malicious image, potentially leading to arbitrary code execution.

EquityPandit 1.0 contains an insecure logging vulnerability (CVE-2019-25605) that allows attackers to capture sensitive user credentials by accessing developer console logs via Android Debug Bridge, specifically exposing plaintext passwords during the forgot password function.

This brief summarizes IOCs extracted from the Maltrail feed on March 15, 2026, covering domains and URLs associated with threats targeting macOS and Android platforms, including OSX_Atomic, FakeApp, Android_Joker, Lummack2, APT_Sidewinder, APT_Kimsuky, and Hak5Cloud_C2.

The openclaw npm package before version 2026.3.22 is vulnerable to arbitrary code execution, where an attacker could inject instructions into the app by invoking the JavascriptInterface bridge from untrusted origins within Android Canvas WebView pages.

CVE-2026-4756 is an out-of-bounds write vulnerability in MolotovCherry Android-ImageMagick7 affecting Android-ImageMagick7 versions before 7.1.2-11, potentially leading to arbitrary code execution.

Katana is a Mirai botnet variant that infects Android TV set-top boxes and compiles its own rootkit for persistence and control.

A use-after-free vulnerability in Google Chrome on Android prior to version 147.0.7727.101 (CVE-2026-6315) allows remote attackers to execute arbitrary code by convincing a user to interact with a crafted HTML page through specific UI gestures.

A missing release of memory after effective lifetime vulnerability exists in MolotovCherry Android-ImageMagick7 before version 7.1.2-11, potentially leading to denial of service.

A CWE-20 improper input validation vulnerability exists in MolotovCherry Android-ImageMagick7 before version 7.1.2-11, potentially allowing for remote code execution or denial of service.