Pixnapping Attack Hijacks Google Authenticator 2FA Codes in Under 30 Seconds

Security researchers have unveiled a technique dubbed Pixnapping that can extract Google Authenticator and other sensitive app codes in under 30 seconds by exploiting Android’s graphics rendering and overlay capabilities. The attack uses Android intents to open exported app activities and layers semi-transparent attacker-controlled activities to leak pixel data, with a three-step process that ends in measuring rendering time differences to recover digits via an optimized OCR-style method.

It has been demonstrated on Google Pixel 6, 7, 8, and 9 devices and Samsung Galaxy S25 phones, achieving leakage rates between 0.15 and 2.11 pixels per second and complete six-digit codes within the critical 30‑second window, with extraction times ranging from 14.3 to 25.8 seconds on Pixel devices. The vulnerability is tracked as CVE-2025-48561 and, according to Google, Google released an initial patch on 2 September 2025, though follow-up disclosures and mitigations are ongoing as of October 13, 2025.

The attack requires no special Android permissions and can hide malicious activity beneath a translucent layer, making protections against pixel extraction a complex, multi-actor challenge.