- First clipper malware discovered on Google Play
- SHEIN app clipboard unintended exposure
- Samsung devices storing clipboard content in plaintext on the devices
- Predator - hooking using YAHFA framework
- Whatsapp hooked using LSPatch, to steal cryptocurrency
- Your Mobile App, Their Playground: The Dark side of the Virtualization
- NoVoice - Modifies Android system libraries
- Malware performing screen recording
- By exploiting Android’s MediaProjection framework, a feature originally intended for legitimate screen sharing and recording
- Malware performing OCR on the screenshots The app is available on the Play store.
- Malware taking screenshots using Accessibility Services
- NFC data capture when physical card is placed near infected device
- PhantomCard - NFC-relay based attacks
- Your Mobile App, Their Playground: The Dark side of the Virtualization (Godfather Malware)
- FjordPhantom Android Malware Targets Banks With Virtualization
- Race conditions on Android Custom Permissions (2014)
- Reverse shell without visible permissions
- Root takeover via signature spoofing in tiann/kernelsu
- Pushing malware via TestFlight and Web Clips
- Tricking App Store Review Into Approving Malicious Apps
- Using enterprise provisioning profile to install malicious apps
- Stealing biometric Data - Trojan, which pretends to be a govt or banking app, steals biometric data. Then uses AI to augment the data and use it as biometric data on real websites
- Access sandbox/RootFS data without Jailbreak