Mobile-platform vulnerabilities and the spyware ecosystem that exploits them — from Pegasus-class commercial surveillance tooling to opportunistic Android malware. Covers OS-level flaws in iOS and Android and the mobile-specific attack surface: baseband, MDM, and sideload channels. Combined article + CVE feed for the Mobile beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-08-23-banking-trojans-manic-grandoreiro-toxicpanda/https://0daynews.com/articles/2026-08-23-banking-trojans-manic-grandoreiro-toxicpanda/Three banking trojans are active: spyware-equipped Manic, persistent Grandoreiro across Latin America and Europe, and an expanded ToxicPanda 2.0.Sun, 23 Aug 2026 04:00:00 GMTMobilearticlehttps://0daynews.com/articles/2026-08-13-android-windrelay-spynote-nfc-relay-fraud/https://0daynews.com/articles/2026-08-13-android-windrelay-spynote-nfc-relay-fraud/WindRelay, a new Android NFC relay malware, is deployed alongside SpyNote RAT to steal live card data and take out fraudulent loans in victims' names.Thu, 13 Aug 2026 04:30:00 GMTMobilearticlehttps://0daynews.com/articles/2026-07-29-flying-eagle-android-rat-telegram-leak/https://0daynews.com/articles/2026-07-29-flying-eagle-android-rat-telegram-leak/Flying Eagle Android RAT source code is circulating on Telegram. Hunt.io traced 170 C2 servers. Block sideloading and audit your MDM policy.Wed, 29 Jul 2026 09:00:00 GMTMobilearticlehttps://0daynews.com/articles/2026-07-21-zhang-arxiv-android-mobile-agent-frameworks-overlay-adb-pivot/https://0daynews.com/articles/2026-07-21-zhang-arxiv-android-mobile-agent-frameworks-overlay-adb-pivot/Zhang et al. published seven attacks against five open-source Android agent frameworks. 2% opacity overlay text feeds prompts to the vision model; unsanitized ADB commands pivot to the host PC.Tue, 21 Jul 2026 14:20:00 GMTMobilearticlehttps://0daynews.com/articles/2026-07-12-redhook-group-ib-wireless-adb-loopback-shizuku-uid-2000/https://0daynews.com/articles/2026-07-12-redhook-group-ib-wireless-adb-loopback-shizuku-uid-2000/Group-IB details RedHook using Accessibility to enable Wireless Debugging, pair over loopback, and run shell as uid 2000. No CVE. Southeast Asia targeted.Sun, 12 Jul 2026 15:00:00 GMTMobilearticlehttps://0daynews.com/articles/2026-07-11-mvpnalyzer-281-android-vpn-study-leaks-tracking/https://0daynews.com/articles/2026-07-11-mvpnalyzer-281-android-vpn-study-leaks-tracking/MVPNalyzer, a University of Michigan / UNM / IIT Delhi tool presented at NDSS 2026, ran 281 top free Android VPN apps and found leaks, plaintext, and trackers.Sat, 11 Jul 2026 19:00:00 GMTMobilearticlehttps://0daynews.com/articles/2026-07-10-android-free-vpn-study-familiar-audit-outcome/https://0daynews.com/articles/2026-07-10-android-free-vpn-study-familiar-audit-outcome/A new study of 281 popular free Android VPN apps found traffic leaks, missing encryption, and tracking. The category has kept failing this test for years.Fri, 10 Jul 2026 13:15:00 GMTMobilearticlehttps://0daynews.com/articles/2026-07-08-redwing-android-maas-oblivion-telegram-zimperium/https://0daynews.com/articles/2026-07-08-redwing-android-maas-oblivion-telegram-zimperium/Zimperium's zLabs details RedWing, an Android bank-fraud MaaS sold on Telegram — Oblivion variant, subscription tiers, prebuilt droppers, 82 target banks.Thu, 09 Jul 2026 02:00:00 GMTMobilearticlehttps://0daynews.com/articles/2026-07-03-pegasus-mep-kouloglou-citizen-lab-analysis/https://0daynews.com/articles/2026-07-03-pegasus-mep-kouloglou-citizen-lab-analysis/Citizen Lab's forensic analysis found that former European Parliament member Stelios Kouloglou was repeatedly infected with NSO Group's Pegasus spyware while serving on the committee tasked with investigating that industry.Fri, 03 Jul 2026 23:15:00 GMTMobilearticle