#mobile-security

Attackers weaponise the LSPosed framework to bypass SIM-binding in payment apps, intercepting SMS, spoofing identities, and funnelling OTPs to Telegram for real-time fraud.

Source: CloudSEK

A flaw in Google Fast Pair lets attackers hijack popular earbuds and headphones, enabling covert pairing, tracking, and eavesdropping.

Source: WhisperPair (KU Leuven COSIC)

A week marked by widespread cloud disruption, active exploitation of critical server flaws, and an escalation in developer supply‑chain threats.

AWS experienced a DNS and load‑balancer outage that disrupted major consumer and developer services and spurred opportunistic phishing campaigns.

CISA added multiple actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalogue, including a Windows SMB privilege escalation and Adobe/Oracle issues.

A critical WSUS deserialisation flaw (CVE‑2025‑59287) was patched after proof‑of‑concept exploits and active attacks were reported.

Developer supply‑chain risks intensified as GlassWorm self‑propagating malware and TARmageddon tar‑parser flaws targeted extension ecosystems and libraries.

State‑linked espionage and ransomware activity continued, with new toolkits and resurgent RaaS operations observed across multiple campaigns.

Romance bait is being weaponised to quietly install GhostChat spyware on Android devices, siphoning private data while chats appear safely routed through WhatsApp.

A sophisticated iOS exploit kit named Coruna is targeting iPhones with 23 exploits, stealing cryptocurrency wallets and sensitive data for espionage and financial attackers.

Source: Google Threat Intelligence Group

Predator spyware hooks into iOS SpringBoard APIs to suppress camera and microphone indicators, allowing covert recording after full device compromise without triggering Apple’s visual privacy alerts.

Source: Jamf

Mirax Android malware campaigns used Meta ads and GitHub-hosted droppers to infect devices, turning them into SOCKS5 residential proxy nodes while stealing credentials via overlays.

Source: Cleafy Labs