One WhatsApp Video Call Could Expose Every Photo on Your Locked Android
On some Android phones, a person holding the locked device can answer a WhatsApp video call, open Meta AI's editor and browse the photo gallery without a PIN or biometric check.
Android
ToxicPanda Blocked Google Play, Then Paired With ADB From Inside the Phone.
ToxicPanda 2.0 abuses VPN permission to cut off Google Play, then automates Android wireless debugging to obtain shell-level capability. The chain shows how legitimate platform functions can become a post-compromise control path.
The Car Wasn’t the Target. Its Trusted Updater Became a Botnet Installer.
DoFun’s trusted TWCore updater installed malware on Android car head units, turning connected dashboards into MoYu proxy-botnet nodes.
Clearing Cookies Did Not Break the Link. The Browser Called the App Through Localhost.
Meta Pixel and Yandex Metrica used Android localhost connections to link browser activity with native-app identities, bypassing familiar privacy controls.