Pixnapping Attack Lets Attackers Steal 2FA on Android

Pixnapping is an Android-focused proof-of-concept exploit that enables a malicious app to stealthily leak information displayed by other apps or websites, including two-factor authentication codes. Developed by researchers at UC Berkeley, the University of Washington, UC San Diego and Carnegie Mellon, the attack demonstrated end-to-end recovery of data from services such as Gmail, Google Accounts, Google Authenticator, Google Maps, Signal, and Venmo, on devices including Google Pixel 6–9 and Samsung Galaxy S25.

The researchers say Google Authenticator can be manipulated to steal 2FA codes in under 30 seconds while the attack remains hidden from the user, and the broader framework targets Android APIs and a hardware side channel. The attack has been designated CVE-2025-48561, and Google told Dark Reading that a patch was released in early September with an additional update promised in the December Android security bulletin; Google reports no observed in-the-wild exploitation to date.

For users, researchers advise staying up to date with security updates, and for developers the mitigation advice remains unclear. According to Google, mitigation is ongoing as the company prepares further patches. Oct 14, 2025.