David Blanc (@speekha) Bsky

Une fois une session proposée, on peut plus la modifier du tout. C'est normal ?

20 hours ago 0 0 1 0

New RecruitRat, SaferRat, Astrinox, Massiv Android Malware Found Targeting 800 Apps Zimperium reveals four active Android malware campaigns, RecruitRat, SaferRat, Astrinox, and Massiv, targeting over 800 banking apps globally.

📢⚠️ Watch out as 4 new Android malware families, RecruitRat, SaferRat, Astrinox, and Massiv, have been found targeting 800 banking and crypto apps.

Read: hackread.com/recruitrat-s...

#CyberSecurity #Android #Malware #Scam

5 days ago 1 2 0 0

Until the time comes for them to pay your wages. That's when they tell you money is so secondary, and you should focus primarily on other things, because the satisfaction of a job well done is so much more important that the satisfaction of a job well paid...

1 day ago 1 0 1 0

I've just blogged about my feelings surrounding the changes coming to add encryption to DataStore, how it works behind the scenes and whether the new functionality is for you 💪

You can check it out here:

sp4ghetticode.medium.com/whats-new-in...

#AndroidDev

3 days ago 9 1 0 0

Hackers Use MiningDropper to Deliver Infostealers, RATs, and Banking Malware on Android A fast growing Android malware campaign is using a framework called MiningDropper to push far more dangerous threats onto phones disguised as normal apps. Researchers describe it as a multi stage delivery system that can lead to infostealers, remote access trojans, banking malware, or even cryptocurrency mining activity on infected devices. The campaign reaches victims through phishing pages , social media links, and fraudulent websites that mimic trusted services, including transport portals, banks, telecom brands, and popular mobile applications. That broad lure strategy gives attackers many ways to trick users into downloading malicious APK files before the hidden payload chain begins. Cyble researchers said they observed a notable surge in MiningDropper activity and linked the malware to multiple campaigns now operating across India, Europe, Latin America, and Asia. One cluster focused on Indian users with infostealer lures, while another delivered BTMOB RAT to wider regional targets through fake app download pages. The impact is serious because MiningDropper is not just a single malicious app but a reusable framework that lets threat actors swap final payloads as needed. Cyble’s telemetry found more than 1,500 samples in the wild over the past month, and many showed very low antivirus detection. Infection mechanism What makes the operation harder to stop is its layered design, which mixes native code, encrypted assets, dynamic DEX loading, and anti emulation checks to delay analysis. Instead of exposing the final malware at once, each stage unlocks the next one only after earlier checks pass, reducing what static scanners can immediately see. MiningDropper attack chain (Source – Cyble) The chain starts with a trojanized version of the open source Android project LumoLight, where malicious actions are launched through the native library librequisitionerastomous.so. Initializing native code execution (Source – Cyble) Inside that library, strings are hidden with XOR obfuscation and decrypted only at runtime, making the code harder to inspect and easier to keep below detection thresholds. The same native component also checks platform details, system architecture, and device model information to decide whether it is running inside an emulator or rooted environment. If the environment looks suspicious from the attacker’s view, the malware can stop its harmful activity, which helps it avoid sandboxes and automated analysis systems. When those checks pass, the library decrypts an asset named x7bozjy2pg4ckfhn with a hardcoded XOR key, produces the first stage DEX payload, and loads it with DexClassLoader for further execution. That first stage then decrypts a second stage file with AES, using key material derived from the filename, a choice that hides the key logic and complicates reverse engineering. The second stage is the part most victims would notice because it can display a fake Google Play update screen, illustrated in Figure 10 Fake Google Play Update activity, to make the infection look routine. Behind that screen, it decrypts more files, reads configuration data, and decides whether to activate a miner path or a user defined payload path for later installation. In the user payload branch, the malware decrypts a ZIP archive and split components, rebuilds the final package, and installs a more capable threat such as BTMOB RAT through the third stage installer. Cyble said that final payload can steal credentials through WebView injections, log keystrokes, exfiltrate data, abuse Accessibility Services, and support real time remote control, screen monitoring, file handling, audio recording, and command execution. For defenders, the case shows how Android threats are moving toward reusable malware frameworks that separate delivery, deception, and monetization, allowing one campaign to shift quickly between banking theft , espionage style access, and silent mining without rebuilding the whole toolset. Users can reduce risk by installing apps only from trusted stores, avoiding links received by SMS, email, or social media, checking permissions before install, keeping Android updated, using MFA for banking apps, and reporting suspicious financial activity quickly if compromise is suspected. Follow us on Google News , LinkedIn , and X to Get More Instant Updates , Set CSN as a Preferred Source in Google . The post Hackers Use MiningDropper to Deliver Infostealers, RATs, and Banking Malware on Android appeared first on Cyber Security News .

Hackers Use MiningDropper to Deliver Infostealers, RATs, and Banking Malware on Android

2 days ago 0 1 0 0

WhatsApp Leaks User Metadata to Attackers Strangers can infer limited info about you without knowing or messaging you, which could theoretically aid certain kinds of malicious activity.

WhatsApp Leaks User Metadata to Attackers

2 days ago 1 1 0 0

NGate Android malware uses HandyPay NFC app to steal card data A new variant of the NGate malware that steals NFC payment data is targeting Android users by hiding in a trojanized version of HandyPay, a legitimate mobile payments processing tool.

NGate Android malware uses HandyPay NFC app to steal card data

1 day ago 0 1 0 0

Apple AirTag tracking can be misled by replayed Bluetooth signals - Help Net Security A relay attack can trick Apple AirTag into showing false locations by replaying Bluetooth signals within Apple’s Find My network.

Apple AirTag tracking can be misled by replayed Bluetooth signals

📖 Read more: www.helpnetsecurity.com/2026/04/17/a...

#cybersecurity #cybersecuritynews #locationtracking #privacy #hardware

5 days ago 0 1 0 0

Apple is working on passcode bug locking out iPhone users : University student says he plans to move to Android, but concedes iOS engineers acting fast

Locked-out iPhone user tells The Reg that Apple is scrambling to fix character flaw passcode bug

5 days ago 0 1 0 0

Google Play is changing how Android apps access your contacts and location - Help Net Security Google Play policy updates add Contact Picker, location button, and account transfer tools to improve privacy, security, and app reviews.

Google Play is changing how Android apps access your contacts and location

📖 Read more: www.helpnetsecurity.com/2026/04/16/g...

#cybersecurity #cybersecuritynews #privacy #policy #Android

6 days ago 0 1 0 0

Two Git Commands Fooled Claude Into Merging Malicious Code - Manifold Security Coding agents are on your endpoints. Do you know what they're doing? Manifold gives security teams runtime visibility into autonomous AI agents.

Manifold Security tricked Claude' GitHub bot to merge malicious code to repositories by spoofing their requests under the names of famous developers

www.manifold.security/blog/spoofed...

1 week ago 18 10 3 0

Fake Ledger Live App on Apple Store Linked to $9.5M Crypto Theft Apple approved a fake Ledger Live app on its App Store, allowing scammers to steal $9.5 million from more than 50 users. Did you install this app?

📢⚠️ Apple approved a fake #LedgerLive app on its App Store, allowing scammers to steal $9.5 million from more than 50 users. Be sure you didn't install this app!

Read: hackread.com/fake-ledger-...

#CyberSecurity #Ledger #LedgerWallet #Crypto #Scam #Apple

1 week ago 1 2 0 0

Anthropic, Google, Microsoft paid AI bug bounties – quietly Exclusive: Researchers who found the flaws scored beer money bounties and warn the problem is probably pervasive

Agents hooked into GitHub can steal creds – but Anthropic, Google, and Microsoft haven't warned users

1 week ago 1 2 0 0

Google Adds Rust-Based DNS Parser into Pixel 10 Modem to Enhance Security Google has announced the integration of a Rust-based Domain Name System (DNS) parser into the modem firmware as part of its ongoing efforts to beef up the security of Pixel devices and push memory-safe code at a more foundational level. "The new Rust-based DNS parser significantly reduces our security risk by mitigating an entire class of vulnerabilities in a risky area, while also laying

Google Adds Rust-Based DNS Parser into Pixel 10 Modem to Enhance Security

1 week ago 2 1 0 0

Microsoft Finds Flaw in Android Crypto Wallets A vulnerability in an Android SDK exposed data of over 30 million crypto wallet users. The flaw has been patched and apps removed from the Play Store.

Microsoft Finds Flaw in Android Crypto Wallets

1 week ago 0 2 0 0

Mirax Android RAT Turns Devices into SOCKS5 Proxies, Reaching 220,000 via Meta Ads A nascent Android remote access trojan called Mirax has been observed actively targeting Spanish-speaking countries, with campaigns reaching more than 220,000 accounts on Facebook, Instagram, Messenger, and Threads through advertisements on Meta. "Mirax integrates advanced Remote Access Trojan (RAT) capabilities, allowing threat actors to fully interact with compromised devices in real

Mirax Android RAT Turns Devices into SOCKS5 Proxies, Reaching 220,000 via Meta Ads

1 week ago 0 1 0 0

Google makes it harder to exploit Pixel 10 modem firmware - Help Net Security Google is adding Rust to Pixel modem firmware, starting with a DNS parser, to reduce memory vulnerabilities in a key part of the device.

Google makes it harder to exploit Pixel 10 modem firmware

🔗 Read more: www.helpnetsecurity.com/2026/04/13/g...

#Google #firmware #cybersecurity

1 week ago 1 1 0 0

The AI assistant

You underestimate them.

1 week ago 1 0 0 0

Android Makers 26 card deck

It's a wrap. On my way back with a bag full of goodies, but mostly food for thoughts I'm going to share with my colleagues and try to apply to our projects. Thanks again, @androidmakers.bsky.social! #AMxDC26

1 week ago 2 1 1 0

Interesting introduction to passkeys and how to handle them on Android by
Kyriakos Georgiopoulos: github.com/Kyriakos-Geo... #AMxDC26

1 week ago 1 0 0 0

Thanks @enthuan.bsky.social !

1 week ago 0 0 0 0

Looks like we ce could have run into each other! 😉 bsky.app/profile/spee...

1 week ago 1 0 2 0

Settings you can use with an accessibility service

TIL there's a "time to take action" accessibility setting for users that need a little extra time to react to events in your app. #AMxDC26

1 week ago 3 1 0 0

Ben Kadel dressed as a very handsome wizard

Another @benkadel.com banger incoming...

1 week ago 18 3 2 0

Well it's an AI generated hello world!🤣 I guess small APK wasn't in the specs!

1 week ago 0 0 0 0

Balrog the flaky test

Can't help but imagine @trishagee.bsky.social as Gandalf now...

1 week ago 0 0 1 0

Bendalf the dark blue

Don't know about the content yetl, but watching @benkadel.com as Bendalf the dark blue... What a masterclass!

1 week ago 1 0 1 0

First @benkadel.com talk: The Lord of Collection Functions - The Fellowship of Kotlin. Seems up to the hype I've heard previous years! 🔥 #AMxDC26

1 week ago 2 0 1 0

Fewer "one shotters" with completed specs

More detailed spec files allowed to avoid the common mistakes, but led to fewer "first try" successes: looks like the more specs we give them, the more LLM struggle to implement them properly. #AMxDC26

1 week ago 0 0 0 0

Analysis Finds That Google's AI Overviews Are Providing Misinformation at a Scale Possibly Unprecedented in the History of Human Civilization A new analysis commissioned by The New York Times suggests that Google's AI Overviews are wrong an astonishing percentage of the time.

Google’s AI Overviews are providing “tens of millions of wrong answers … every hour — and hundreds of thousands every minute.”

wow, i love the AI future!

2 weeks ago 399 154 4 21

Posts by David Blanc