Research reports
1,224 reports from 387 publishers45 added in the past week
35 reports, newest added first
Added Sun 25 Oct
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Retefe (Android) Tool: Retefe (Android) Names Retefe (Android) Category Malware Type Banking trojan, Backdoor, Info stealer, Credential stealer, Botnet (GovCERT.ch) Recently, some anti-virus…
MalwareInfostealersMobile
Added Mon 19 Oct
Added Sun 18 Oct
Hack Brief: Emergency-Number Hack Bypasses Android Lock Screens
If you protect your Android phone with a password rather than an unlock pattern or PIN, you may want to keep it in your sight a little more carefully than usual. A new, dead-simple attack could allow anyone who gets their hands on it to bypass that password…
Mobile
Linked Devices
You can link a Desktop, iPad, iPhone, or Android device (tablet or phone) to your primary Signal Device. All Signal communication on linked devices is private, just like your smartphone. Note: A device can only be linked a device during the registration flow,…
Mobile
Added Wed 14 Oct
Jamf Apple Device Management. Mac iPad iPhone TV Apple MDM
Govern AI on Mac. Manage all of Apple. The control plane for enterprise AI, built on the platform that manages and secures every Apple device. We help organizations succeed with Apple at scale. Whether you have a handful of Mac, iPhone, iPad, Apple Watch,…
Mobile
Added Tue 15 Sep
Koktevrat – wieloetapowy Android RAT dystrybuowany pod przykrywką aplikacji MandatGO
No excerpt available.
MalwareMobile
The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile
The zLabs team recently identified an updated variant of ToxicPanda, the Android banking Trojan known to have primarily targeted Europe, that introduces significant enhancements, including a comprehensive command set of 167 remote commands and substantially…
Mobile
Added Tue 1 Sep
public-research/cecbot/report.md at main · deepfield/public-research
No excerpt available.
Botnets and DDoSMobile
Added Tue 28 Jul
Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation
In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised SonicWall Secure Mobile Access (SMA) VPN appliances through a chain of multiple zero-day exploits in the…
VulnerabilitiesMobile
Added Wed 10 Jun
A rigged game: ScarCruft compromises gaming platform in a supply-chain attack
ESET researchers uncovered a multiplatform supply-chain attack by North Korea-aligned APT group ScarCruft, targeting the Yanbian region in China – home to ethnic Koreans and a crossing point for North Korean refugees and defectors. In the attack, probably…
MalwareSupply chainMobile
Added Thu 28 May
Android Bankers: 4 Campaigns In A Row
In recent months, Zimperium’s zLabs team has identified a surge in Android Banking Trojan activity, marking a sophisticated shift in the mobile threat landscape. Our researchers successfully tracked four distinct campaigns, RecruitRat, SaferRat, Astrinox, and…
Mobile
Added Tue 19 May
New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps
Modern Android banking malware increasingly evolves through architectural redesigns intended to improve stealth, resilience, and operational flexibility rather than through entirely new user-facing capabilities. As platform protections and detection measures…
MalwareMobile
Added Thu 14 May
Kaspersky discovers Keenadu – a multifaceted Android malware that can come preinstalled on new devices
Kaspersky has detected a new malware for Android devices that it dubbed Keenadu. This malware is distributed in multiple forms – it can be preinstalled directly into devices’ firmware, embedded within system apps, or even downloaded from official app stores…
MalwareMobile
The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors
Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword.…
VulnerabilitiesMobile
Added Sat 9 May
Coruna: A Complete Technical Teardown of a State-Grade iOS/macOS Watering-Hole Exploit Chain
Author: @Nadsec | Date: March 2026 | Classification: Threat Intelligence - Public Abstract Coruna is a multi-stage, multi-platform exploit chain targeting Apple's Safari/WebKit engine and XNU kernel on ARM64 (arm64e) devices running iOS and macOS. Operated by…
VulnerabilitiesMobile
Added Tue 5 May
Craxs Rat, the master tool behind fake app scams and banking fraud
Since April 2023, a series of scams involving fake Android apps have targeted Singapore. These fake apps are banking trojans used to harvest victims’ banking credentials and personal information, as well as to take control of their devices. In this specific…
MalwareMobile
Group-IB uncovers Android Trojan named «Gustuff» capable of targeting more than 100 global banking apps, cryptocurrency and marketplace applications
Group-IB, an international company that specializes in preventing cyberattacks, has detected activity of Gustuff a mobile Android Trojan, which includes potential targets of customers in leading international banks, users of cryptocurrency services, popular…
MalwareMobile
BianLian - from rags to riches, the malware dropper that had a dream
Recently, while analyzing our daily portion of APK files, searching for the new banking related threats, we found a sample that was standing out among the others. While being seemingly benign, the sample was downloading and installing the infamous Anubis…
MalwareMobile
Godfather Trojan - mobile banking malware that is impossible to refuse
The Android banking Trojan Godfather is currently being utilized by cybercriminals to attack users of popular financial services across the globe. Godfather is designed to allow threat actors to harvest login credentials for banking applications and other…
MalwareMobile
Added Fri 1 May
Finland says it found NSO's Pegasus spyware on diplomats' phones
The Finnish government said today that the telephones of some of its foreign diplomats were infected last year with Pegasus, a spyware strain developed by controversial Israeli surveillance vendor NSO Group. Finland's Ministry of Foreign Affairs said the…
Mobile
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.