A recent report has revealed that many VPNs might allow others to sniff your data—and they're not being honest about who's behind them.

People use VPNs for different security and privacy reasons, to access content anonymously, or to bypass content controls and age verification by pretending to be in different places. But not all VPNs are created equal. A recent report has revealed that many of them might allow others to sniff your data—and they’re not being honest about who’s behind them.

The report, called Hidden Links: Analyzing Secret Families of VPN Apps, comes from researchers at the University of Toronto’s Citizen Lab, and Arizona State University. It warns that several Android VPN apps for sale via the Google Play Store have security flaws that allow others to snoop on their traffic. They’re also deceiving users about their ownership, warns the report:

> “The providers appear to be owned and operated by a Chinese company and have gone to great lengths to hide this fact from their 700+ million combined user bases.”

The researchers looked at the 100 most-downloaded VPNs and took the half of them that were not US-based. Then they scanned websites, business filings, and the VPN apps’ source code to try and find links between them. Using a combination of data points found in these resources, they found common software libraries, technical infrastructure, and business details that allowed them to group the VPN apps into three families.

_Family A_ contained eight VPN applications linked to providers Innovative Connecting, Autumn Breeze, and Lemon Clove. These apps all shared some common security flaws. These included a hard-coded key used to create a password for Shadowsocks, a service designed to circumnavigate the Chinese government’s digital censorship system. This flaw enables anyone to decrypt communications sent using these apps.

From the report:

> “On many of the VPNs we analyzed, a network eavesdropper between the VPN client and VPN server can use the hard-coded Shadowsocks password to decrypt all communications for all clients using the apps.”

Just as worrying is the undisclosed collection of user location data by these apps, even though the providers’ privacy policies claim that they don’t do this. They request the zip code of the user’s public IP from ip-api.com and upload it to a database, the researchers said.

The Tech Transparency Project has previously connected three providers responsible for these apps with Chinese cybersecurity firm Qihoo 360, which the US has sanctioned for its connections to the Peoples’ Liberation Army.

_Family B_ consisted of six providers, who between them are responsible for apps including Global VPN, XY VPN, and Super Z VPN, all of which use the same VPN servers. They had hard-coded passwords for Shadowsocks, too. In general, the researchers warn against using apps that rely on Shadowsocks for anonymity. It was designed for getting around China’s censorship system, not maintaining anonymity, they said:

> “It was counterintuitive to find deprecated ciphers and hard-coded passwords in these apps, given that they are security-sensitive apps and many of their providers are owned by Qihoo 360, a major chinese cybersecurity firm.”

_Family C’s_ two providers were responsible for VPNs such as Fast Potato VPN and X-VPN, which also had security issues. This family, like the others, was also susceptible to other attacks, including what’s known as a blind in/on-path attack. This lets people manipulate traffic from a device using the app if they’re on the same network.

**Why are these apps in the Play Store?**

Why might companies seek to operate multiple VPNs and then hide the fact? The researchers muse that they might be trying to avoid reputational damage if something happens to one VPN. They share code because it’s simply more cost-effective to do so, the report added.

The takeaway here is that plenty of VPNs are not what they seem. That’s worrying, given that the people running the servers that the apps connect to can read all of the traffic—as can others who just reverse-engineer the passwords from the apps. So why doesn’t Google stop it?

One of the big problems is that the relationships between the different app providers are time-intensive to figure out. That makes it hard for the app store operators to automate at scale, the researchers point out. On the other hand, Google make $28.19bn in net profit for Q2 2025 alone, so maybe it could find some spare change down the back of the couch and put some manual investigators on it.

> “Google is potentially exposing its brand to reputational damage by hosting and profiting from deceptive and insecure apps like the ones we investigated.”

It’s hard to know which providers to trust online. We suggest you research any security product carefully, and go for a trusted company with a solid reputation. Malwarebytes offers a VPN of our own here.

 Popular Android VPN apps found to have security flaws and China links 

The French data protection authority has fined Google and Chinese e-commerce giant Shein $379 million (€325 million) and $175 million (€150 million), respectively, for violating cookie rules.
Both companies set advertising cookies on users' browsers without securing their consent, the National Commission on Informatics and Liberty (CNIL) said. Shein has since updated its systems to comply with

The French data protection authority has fined Google and Chinese e-commerce giant Shein $379 million (€325 million) and $175 million (€150 million), respectively, for violating cookie rules.

Both companies set advertising cookies on users' browsers without securing their consent, the National Commission on Informatics and Liberty (CNIL) said. Shein has since updated its systems to comply with the regulation. Reuters reported that the retailer plans to appeal the decision.

"When creating a Google account, users were encouraged to choose cookies linked to the display of personalized advertisements, to the detriment of those linked to the display of generic advertisements and that users were not clearly informed that the deposit of cookies for advertising purposes was a condition to be able to access Google's services," the CNIL noted.

The consent obtained in this manner is not valid and constitutes a violation of the French Data Protection Act (Article 82), it added. It's worth noting that while this was the default behavior until October 2023, when the company added an option to refuse cookies, "the lack of informed consent still persisted."

Google has also been called out for placing advertisements in the form of emails among other emails in the "Promotions" and "Social" tabs of Gmail, stating that the display of such ads required users' explicit consent in accordance with the French Postal and Electronic Communications Code (CPCE).

French telecommunications operator Orange was fined €50 million back in December 2024 for similarly displaying ads between actual email messages without users' consent. Google has been ordered to bring its systems into compliance within six months, or risk facing penalties of €100,000 per day.

The development comes as a U.S. jury found Google to have violated users' privacy by collecting their data even after they opted out of Web & App Activity tracking. The decision, which awards $425 million in compensatory damages, is the culmination of a class action lawsuit filed against the company in July 2020.

In related privacy-related announcements, the U.S. Federal Trade Commission (FTC) said Disney has agreed to pay $10 million to settle allegations that it collected personal data from children watching YouTube videos without parental notification or consent, thus violating the U.S. Children's Online Privacy Protection Rule (COPPA).

The agency said Disney failed to properly label some videos that it uploaded to YouTube as "Made for Kids," thus allowing it to gather data from children under 13 who watched that content and use it to serve targeted ads.

In addition to the $10 million fine, the proposed settlement requires Disney to begin alerting parents before collecting personal data from children under age 13 and obtain their consent in accordance with COPPA. Disney is also required to start a program to ensure that videos it uploads to YouTube are properly designated as intended for kids.

Separately, the FTC is also taking action against a China-based robot toy maker, Apitor Technology, over allegedly permitting a third-party called JPush to collect children's geolocation data without their knowledge and parental consent in violation of COPPA.

"Apitor integrated a third-party software development kit called JPush into its \[Android\] app that allowed JPush's developer to collect location data and use it for any purpose, including advertising," FTC said. "After Android users download the Apitor app, it begins collecting and sharing users' precise location data with JPush's servers, unbeknownst to child users and their parents."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Google Fined $379 Million by French Regulator for Cookie Consent Violations

Google has issued updates to patch a whopping 111 Android vulnerabilities, including two actively exploited ones.

Google has patched 111 vulnerabilities in Android, including two critical flaws, in its September 2025 Android Security Bulletin.

While the last few months have been quite calm regarding the number of vulnerabilities, this month is a real whopper with 111, compared to 6 in August and none in July.

The September updates are available for Android 13, 14, 15, and 16. Android vendors are notified of all issues at least a month before publication, however, this doesn’t always mean that the patches are available for all devices immediately.

You can find your device’s Android version number, security update level, and Google Play system level in your Settings app. You’ll get notifications when updates are available for you, but you can also check for them yourself.

For most phones it works like this: Under **About phone** or **About device** you can tap on **Software updates** to check if there are new updates available for your device, although there may be slight differences based on the brand, type, and Android version you’re on.

If your Android phone shows patch level 2025-09-05 or later then you can consider the issues as fixed.

Keeping your device as up to date as possible protects you from known vulnerabilities and helps you to stay safe.

**Technical information**

Google notes that:

> “there are indications that the following may be under limited, targeted exploitation.
> 
> CVE-2025-38352
> 
> CVE-2025-48543”

But it doesn’t provide any details about how and against whom these vulnerabilities were used. So, let’s have a closer look at those two first.

CVE-2025-38352 is a race condition vulnerability in the Linux kernel time subsystem, which may allow a local attacker to gain an elevation of privilege (EoP).

A race condition vulnerability means that during a moment where different threads (processes or programs) use the same resource,  but they are not synchronized, it creates a brief period during which an attacker could exploit the race window.

In this case the resource is the CPU time, the amount of time that a central processing unit (CPU) was used for processing instructions of a computer program or operating system.

A “local attacker” which can also be an installed app or shell could exploit this vulnerability to gain permissions it would normally not get or have.

CVE-2025-48543 is a vulnerability in Android runtime. The Android Runtime (ART) is the system responsible for running applications on Android devices. Basically it translates instructions into machine code which the processor understands. The vulnerability could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

And then there is the vulnerability tracked as CVE-2025-48539. This critical vulnerability was found in the System component and could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed and no user interaction required.

The part where the description says remote (proximal/adjacent) is a bit of a mystery, but our best guess is this means an attacker could compromise a device from a short distance, so it might be by means of Bluetooth, NFC, or Wi-Fi Direct.

This type of vulnerability always makes researchers nervous, because they could be “wormable,” meaning they can spread from one device to the next. And if that is true, they can spread like wildfire in crowded environments like concerts and conferences.

**We don’t just report on phone security—we provide it**

Cybersecurity risks should never spread beyond a headline. Keep threats off your mobile devices by downloading Malwarebytes for iOS, and Malwarebytes for Android today.

 Update your Android! Google patches 111 vulnerabilities, 2 are critical 

A highly sophisticated email scam is targeting PayPal users with the subject line of "Set up your account profile."

_A co-worker forwarded this rather convincing PayPal scam to me. Thanks Elena._

A highly sophisticated email scam is targeting PayPal users with the subject line of “Set up your account profile.”

We decided to see what the scammers are after. First thing to do is to look at the headers:

The sender address service@paypal.com (sometimes the emails come from service@paypal.co.uk) looks legitimate because it is, but the scammers have spoofed the address.

Basically, when someone sends an email, their computer tells the email system what address to show as the sender. Scammers take advantage of this by using special software or programs that let them type in any “From” address they want. This technique is called spoofing. The scammer sends their email through the internet, and since most email systems aren’t strict about checking this information, the fake sender address is displayed just like a real one would be.

So it’s hard for the everyday user to tell if the email has been spoofed or not.

There are other signs that the email might be a scam though. There is the unusual recipient address, which is nothing like the one of my co-worker. Rather than targeting one individual, scammers set up a distribution list (often using Microsoft 365/Google test domains) with their own domain or, in this case, a compromised one. This allows them to send bulk phishing emails while masking their intent, but does mean that recipients see an unfamiliar address, e.g. {somebody}@{unknow-domain}.test-google-a.com, instead of their own.

The “.test-google-a.com” part of the address refers to a domain often used in testing or in cloud setups through Google Workspace, but in the context of this scam email, it’s a strong indicator of malicious activity or advanced phishing techniques rather than official Google practice. So, that’s red flag #1.

When looking at the email itself, the subject line has nothing to do with what the email is asking the target to do. That’s red flag #2.

> “**Set up your PayPal account profile**  
> New Profile Charge: We have detected a new payment profile with a charge of $910.45 USD at Kraken.com. To dispute, contact PayPal at (805) 500-8413. Otherwise, no action is required. PayPal accept automatic pending bill from this account.Your New PayPal Account added you to the Crypto Wallet account.  
> Your user ID: Receipt43535e  
> Use this link to finish setting up your profile for this account. The link will expire in 24 hours.”

The layout of the email looks convincing enough, likely copied from an actual PayPal email.

The content however is typical for a phishing email:

*   Urgency: The link will expire in 24 hours.
*   Amount: Over $900 dollars to grab your attention
*   Crypto wallet: most people have only a vague notion of how crypto wallets work, so they don’t see the lie immediately. And Kraken.com is a crypto trading platform, so there is no discrepancy there.
*   The phone number listed is known by the Better Business Bureau as related to this type of scam
*   The recipient is not addressed by name in the email. Legitimate PayPal emails will always address you by your full name or business name, never generic greetings like “Dear Customer” or “Dear User”, or none at all as in this example. Red flag #3, 4, 5, 6, and 7.

The language used in the email is not perfect, but also not bad enough to stand out like a sore thumb. We have discussed in the past how AI-supported spear phishing fools more than 50% of targets, so looking for spelling errors is often not helpful these days.

But now comes the part which showcases the sophistication level of this scam. The link the button in the email points to, actually goes to PayPal.

However, the effect is different from what the target of the phishing email would expect. They are not going to set up a profile nor dispute a payment.

By clicking the link in the email, the target starts the routine to add a secondary user to their PayPal account. The danger here is that a secondary user can issue payments. In other words, the scammer would be able to clean out your PayPal account.

PayPal has over 434 million active users so for phishers that’s a large target audience. To make their attacks more targeted, some groups of phishers will buy or steal large databases of email addresses that are associated with PayPal accounts or which have previously interacted with PayPal services.

**How to stay safe**

As far as we could determine this campaign has been running for a month or more. Here are some tips to help you avoid being caught out:

*   Look out for the red flags above.
*   Always search phone numbers and email addresses to look for associations with known scams.
*   Go directly to PayPal.com to see if there are any messages for your account.
*   Enable two-factor authentication (2FA) to add an extra layer of security to your PayPal account and help prevent scammers getting in.
*   Report suspicious emails and phishing emails to phishing@paypal.com. Then delete them.

**We don’t just report on scams—we help detect them**

Cybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard, a feature of our mobile protection products. Submit a screenshot, paste suspicious content, or share a text or phone number, and we’ll tell you if it’s a scam or legit. Download Malwarebytes Mobile Security for iOS or Android and try it today!

 PayPal users targeted in account profile scam 

Passkeys were built to enable a password-free future. Here's what they are and how you can start using them.

All products featured on WIRED are independently selected by our editors. However, we may receive compensation from retailers and/or from purchases of products through these links. Learn more.

Passwords suck. They're hard to remember, but worse is playing the ever-evolving game of cybersecurity whack-a-mole with your most important accounts. That’s where passkeys come into play. The so-called “war on passwords” has taken off over the past two years, with titans like Google, Microsoft, and Apple pushing for a password-less future that the FIDO Alliance (a consortium made to “help reduce the world’s over-reliance on passwords”) has been trying to realize for over a decade.

Like it or not, you’ll be prompted to create a passkey at some point, and you likely already have. That’s a good thing, as passkeys aren’t only much easier to use than a traditional password, they’re also a lot safer. Here's everything you need to know about using them.

_Updated September 2: We've added a few details on about restoring passkeys and mentioned non-biometric authentication options._

Passkeys offer a way of confirming you are who you say you are without remembering a long, complicated password, and in a manner that's resistant to common attacks on passwords like phishing and dictionary attacks.

“Passkeys are built to replace passwords and outdated forms of two-factor authentication entirely,” Andrew Shikiar, executive director and CEO of the FIDO Alliance, tells WIRED. They represent a rare step forward in cybersecurity; one that’s not only easier to use than previous methods but also safer.

Conceptually, passkeys can come in many forms, but you’ll most commonly interact with them on a device you own. For example, imagine you want to sign in to your Google Account on a new device. Instead of entering a password, a passkey allows you to log in to your account with a device you’ve already verified. You can use your phone as a passkey, which instantly grants access to your Google Account without ever entering a password. The best implementations of passkeys don’t even need a username.

Passkeys end up being safer and more convenient than passwords because they work in a fundamentally different way. Passwords are what you’d call a “shared secret” in the world of cybersecurity. You know the secret, and so does the service you’re signing in to. The problem is that you have to remember that secret, and you aren’t fully in control of it, as you have to share that secret with whatever service you’re using. A data breach and a little decryption time are all that's needed to end up with a compromised account, and you didn't even do anything wrong.

Passkeys use public-key cryptography. Instead of matching a shared secret, public-key cryptography works by matching a pair of keys—a public key that anyone can see, and a private key that only you have access to. It’s safer because only you have access to your private key, and it’s easier because that key is bound to some device you own and usually secured with biometrics.

In the event your device is lost or stolen, you can restore your passkeys using the account you created it with. For instance, Google allows you to store passkeys in the Google Password Manager and sync them across your devices. Windows and iCloud Keychain only work on their respective operating systems, but they're tied to your Microsoft and Apple accounts, respectively.

**Are Passkeys Safe?**

Passkeys are safe, even more so than a long, random password. When you sign in with a passkey, you send a handful of information to the service you’re signing into, including your public key, which is stored as a representation of you as a user. This information alone doesn’t do anything.

On the device where you created the passkey, you'll have to engage in a “challenge” to unlock your private key, usually some form of biometric authentication. If the challenge is successful, it’s signed and sent back to the service you’re trying to log into. That challenge is then checked against the public key, and if it’s a match, you’re given access. Critically, this authentication happens on your device, not on a server far away.

Although biometric authentication is how you'll typically interact with passkeys on a mobile device, it's not a requirement. On Windows, for example, you need to authenticate with Windows Hello, which can use your device's PIN. On Android, you can use a pin or pattern.

With a password, there’s a ton of room for an attacker to potentially steal your password. Data breaches might expose your password, and even if it’s encrypted, it can be cracked. Phishing schemes are an easy vector of attack for hackers looking to steal passwords. And, if you’re using a service with spotty security practices, you could have a password exposed as plaintext in a breach; there are dozens and dozens of examples of this happening before.

**Passkeys vs. 2FA and MFA**

Passkeys are tricky because they fly in the face of security conventions that have been around for years—namely, two-factor (2FA) or multifactor authentication (MFA). Although you don’t need to plug in a code from a text or copy something over from an authenticator app, passkeys inherently use multifactor authentication. It just happens so fast that it’s easy to miss.

MFA is about adding additional layers of protection beyond your password. Instead of just your password, you need it and a code texted to you, for example. Passkeys already work that way. You need to match the public-private key pair, but you also need to authenticate that you have access to that private key. It’s not “something you know and something you own,” as 2FA is normally described, but it’s still two layers of authentication.

Here's how Shikiar describes it: “When you sign in, the service issues a cryptographic challenge that can only be answered with the private key on your device, verified by something you have (like your phone or laptop) and often something you are (like a biometric). The result is a phishing-resistant login with no reusable credentials to steal.”

**Devices and Browsers That Support Passkeys**

Passkeys are broadly integrated at an operating system level. If you’re using an OS that doesn’t natively support passkeys—i.e., Linux—you can still use them. However, you’ll need to use another device, like your phone, to scan a QR code and authenticate yourself, or a third-party password manager.

Here are the operating systems that fully support passkeys:

*   Android 9 or newer
*   iOS 16 or newer
*   macOS 13 (Ventura) or newer
*   Windows 10/11 23H2 or newer

Each one of these operating systems supports passkeys for native apps, as well as in your browser. Chromium supports passkeys, which covers the vast majority of browsers available, including Brave, Opera, Vivaldi, and Google Chrome. The major non-Chromium browser, Mozilla Firefox, also supports passkeys on version 122 or newer.

**How to Create and Store Passkeys**

To use passkeys, you need to store them somewhere. The major operating systems that support passkeys already include a way to store them, but they aren’t created equally.

Windows 10 and Windows 11

You need to set up Windows Hello to use passkeys on Windows 10 or Windows 11. You might have set it up during installation, but if not, you can enable it in the **Settings** app by clicking **Accounts > Sign-in options**. Whenever you want to use a passkey, you’ll need to authenticate with Windows Hello, be it with your face, fingerprint, or PIN.

Windows 10 or 11, version 23H2 or later, will prompt you to use a passkey whenever you attempt to sign in to a supported service on a supported browser (or through a native Windows app). Unlike other operating systems, these passkeys aren’t synced across your devices. They only work on your Windows device.

Both macOS and iOS store passkeys on your iCloud Keychain, so you’ll need to turn your Keychain on if it’s not already enabled. You can turn it on in the **Settings** app by following **Apple ID > iCloud > Passwords and Keychain**. You’ll need to enable 2FA for your Apple ID to use iCloud Keychain.

Similar to Windows, you’ll be prompted to create a passkey whenever you create a new account with a service that supports passkeys. If you want to add a passkey to an already created account, you’ll have to do so through that application’s settings. Unlike Windows, these passkeys work across devices, assuming you have access to your iCloud Keychain.

In newer versions of macOS (version 15 and later), it’s much easier to create and manage passkeys through the dedicated Passwords app.

iOS follows the same principles as macOS when it comes to Passkeys. They’re stored in your iCloud Keychain and synced across your devices. In iOS 18 and newer, you can manage passkeys in the dedicated Passwords app, and in older versions, you can find them in your settings.

iOS via Jacob Roach

iOS via Jacob Roach

Android 9 and newer versions support passkeys, but in different forms. By default, passkeys in Android will use the Google Password Manager, which is tied to your Google Account and syncs across your devices. On Android 14 and newer, you can choose to store your passkeys elsewhere, such as in a third-party password manager.

Passkeys in a Password Manager

Chrome via Jacob Roach

If you want all your passkeys on all your devices, operating system be damned, you need a password manager. Most of the best password managers support passkeys, allowing you to store and sync them on nearly any device. I personally use 1Password, but services like NordPass, Bitwarden, and Dashlane also support passkeys. You can create and store passkeys with a password manager on Android and iOS.

Keep your logins locked down with our favorite password management apps for PC, Mac, Android, iPhone, and web browsers.

**Apps That Support Passkeys**

There are only a few places where you can store and sync passkeys, but plenty of services support passkeys for signing in. The usual suspects include Microsoft, Adobe, Amazon, Google, and Apple, but there are still many websites and apps that don’t support passkeys.

You can find a handful of directories that claim to hold a complete list of apps that support passkeys with a quick Google search. 1Password maintains one directory, as do a couple of B2B services, including a directory from Hanko and another from OwnID. These aren’t complete lists. Meta apps like Facebook and Instagram aren’t listed, for example, despite adding support for passkeys in June 2025.

The best directory I’ve come across is from a nonprofit called 2factorauth in Sweden. It’s hosted on GitHub, updated constantly, and critically, maintained by the community. It’s the most up-to-date I’ve found, and apps are even organized into categories so you can, for instance, pick a VPN service that supports passkeys.

**Passkeys Will (Eventually) Replace Passwords**

Passkeys were built to replace passwords, but we’re in the middle of a long, arduous transition to get there. It requires every app, device, and operating system to adopt a new standard of authentication and ditch a model we've been using for decades throughout our entire digital lives.

The inflection point is well underway, though. With major services adopting passkeys, it’s possible to use them across your most important accounts. If nothing else, it’s worth using passkeys on accounts that are connected to others, such as your Google or Facebook account if you use social sign-on features.

Despite offering clear security advantages, passkeys aren't a (excuse the pun) turnkey solution for better security. As Shikiar puts it, “Passkeys secure the front door, but organizations still need to harden the entire identity journey, ranging from onboarding and recovery to session management.”

**_Power up with unlimited access to_ WIRED_._** _Get best-in-class reporting and exclusive subscriber content that's too important to ignore. Subscribe Today._

What Is a Passkey? Here’s How to Set Up and Use Them (2025)

Google has shipped security updates to address 120 security flaws in its Android operating system as part of its monthly fixes for September 2025, including two issues that it said have been exploited in targeted attacks.
The vulnerabilities are listed below -

CVE-2025-38352 (CVSS score: 7.4) - A privilege escalation flaw in the Linux Kernel component 
CVE-2025-48543 (CVSS score: N/A) - A

Mobile Security / Vulnerability

Google has shipped security updates to address 120 security flaws in its Android operating system as part of its monthly fixes for September 2025, including two issues that it said have been exploited in targeted attacks.

The vulnerabilities are listed below -

*   **CVE-2025-38352** (CVSS score: 7.4) - A privilege escalation flaw in the Linux Kernel component
*   **CVE-2025-48543** (CVSS score: N/A) - A privilege escalation flaw in the Android Runtime component

Google said both vulnerabilities could lead to local escalation of privilege with no additional execution privileges needed. It also noted that no user interaction is required for exploitation.

The tech giant did not reveal how the issues have been weaponized in real-world attacks and if they are being put to use in tandem, but acknowledged there are indications of "limited, targeted exploitation."

Benoît Sevens of Google's Threat Analysis Group (TAG) has been credited with discovering and reporting the upstream Linux Kernel flaw, indicating that it may have been abused as part of targeted spyware attacks.

Also patched by Google are several remote code execution, privilege escalation, information disclosure, and denial-of-service vulnerabilities impacting Framework and System components.

Google has released two security patch levels, 2025-09-01 and 2025-09-05, so as to give flexibility to Android partners to address a portion of vulnerabilities that are similar across all Android devices more quickly.

"Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level," Google said.

Last month, the tech giant Google released security updates to resolve two Qualcomm vulnerabilities -- CVE-2025-21479 (CVSS score: 8.6) and CVE-2025-27038 (CVSS score: 7.5) -- that were flagged by the chipmaker as actively exploited in the wild.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Android Security Alert: Google Patches 120 Flaws, Including Two Zero-Days Under Attack

Californians are receiving scammy text messages that tell them they're owed a tax refund. Don't click any links or reply!

The State of California Franchise Tax Board (FTB) recently issued a warning to taxpayers to protect themselves from tax scams. In their warning the FTB states:

> “Recently, the FTB received reports of a scam targeting taxpayers through text messages that appear to be from FTB. These text messages contain a link to a fraudulent version of certain FTB web pages, which are designed to steal personal and banking information. The scam aims to trick taxpayers into providing personal details and credit card information.”

As if to prove their point, one of my co-workers received this text message.

> “State of California Franchise Tax Board (FTB)
> 
> Your tax refund claim has been processed and approved. Please provide your accurate collection information before September 01, 2025.
> 
> We will deposit the money into your bank account or email paper check within 1-2 working days.
> 
> {link}
> 
> Failure to submit required payment information by September 01, 2025 will result in permanent forfeiture of this refund under California Revenue and Taxation Code Section 19322.
> 
> Just reply with ‘Y’, then close and reopen the message to make the link work. If that doesn’t do it, copy the link and paste it straight into Safari.
> 
> California Franchise Tax Board|Sacramento, CA|Official State Agency”

The links that we found for this campaign are designed to look legitimate by using ftb.ca, ftb.gov, or ftb.cagov in the URL. The sites are designed to mimic the official version of certain FTB web pages, but in reality they are designed to steal your personal and banking information.

**How to tell if a message is a scam**

This type of scam is not limited to California or even to tax returns, so this advice is good for everyone. Here are some scammy signs to watch out for:

*   **Suspicious domain names:** Official tax authorities only use domains ending in “.gov”. Any link leading to “ftb.ca-nt.cc” or other odd-looking domains is a major red flag.  
*   **Urgent or threatening language:** Scammers often try to rush recipients with claims like “permanent forfeiture of your refund” and tight deadlines.
*   **Requests for sensitive personal or financial information:** Legitimate agencies never ask for bank account info or other private details via text message.
*   **Promised instant rewards:** Messages offering immediate deposits should not be trusted.
*   **Odd instructions for opening links:** Watch out for steps like “reply with ‘Y’, then close and reopen the message” or pasting the link into Safari. This is a scam tactic to bypass security features.
*   **Foreign phone numbers:** US federal and state agencies only use official numbers, not foreign codes. A sender like +63 (Philippines) pretending to be a US state agency is a sure giveaway of fraud.
*   **Grammatical mistakes, strange wording, and formatting errors:** Even though the use of AI by scammers has reduced the number of these signs, they sometimes occur. “Email paper check” is a good example.
*   **Generic sign-offs or incomplete contact details:** Real tax authorities provide clear and official contact information.

Spotting any one of these signs should be enough to delete the message. Never click links or provide personal details based on unsolicited texts or emails.

Other tips to stay safe are:

*   Keep your device and the software on it up to date.
*   Use an active anti-malware protection, preferably with a web protection module.
*   If you’re worried something is a scam and want to confirm it, Malwarebytes users can submit suspicious messages to Scam Guard.

You can also visit the FTB Scams page to verify when FTB sends texts and what information is included.

**Indicators**

We have spotted these subdomains in this campaign:

ftb.gov-ciehka.xmnsia\[.\]cc

ftb.ca-nt\[.\]cc

ftb.cagov-Ibh\[.\]cc

ftb.cagov-tqn\[.\]cc

ftb.cagov-cg\[.\]cfd

ftb.cagov-onr\[.\]cc

ftb.cagov-jme\[.\]cc

ftb.cagov-etu\[.\]cc

ftb.cagov-ib\[.\]cc

ftb.ca-mg\[.\]cc

ftb.gov-qls\[.\]help

**We don’t just report on scams—we help detect them**

Cybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard, a feature of our mobile protection products. Submit a screenshot, paste suspicious content, or share a text or phone number, and we’ll tell you if it’s a scam or legit. Download Malwarebytes Mobile Security for iOS or Android and try it today!

 Tax refund scam targets Californians 

Cybersecurity researchers are calling attention to a new shift in the Android malware landscape where dropper apps, which are typically used to deliver banking trojans, to also distribute simpler malware such as SMS stealers and basic spyware.
These campaigns are propagated via dropper apps masquerading as government or banking apps in India and other parts of Asia, ThreatFabric said in a report

Cybersecurity researchers are calling attention to a new shift in the Android malware landscape where dropper apps, which are typically used to deliver banking trojans, to also distribute simpler malware such as SMS stealers and basic spyware.

These campaigns are propagated via dropper apps masquerading as government or banking apps in India and other parts of Asia, ThreatFabric said in a report last week.

The Dutch mobile security firm said the change is driven by recent security protections that Google has piloted in select markets like Singapore, Thailand, Brazil, and India to block sideloading of potentially suspicious apps requesting dangerous permissions like SMS messages and accessibility services, a heavily abused setting to carry out malicious actions on Android devices.

"Google Play Protect's defences, particularly the targeted Pilot Program, are increasingly effective at stopping risky apps before they run," the company said. "Second, actors want to future-proof their operations."

"By encapsulating even basic payloads inside a dropper, they gain a protective shell that can evade today's checks while staying flexible enough to swap payloads and pivot campaigns tomorrow."

ThreatFabric said that while Google's strategy ups the ante by blocking a malicious app from being installed even before a user can interact with it, attackers are trying out new ways to get around the safeguards -- an indication of the endless game of whack-a-mole when it comes to security.

This includes designing droppers, keeping in mind Google's Pilot Program, so that they don't seek high-risk permissions and serve only a harmless "update" screen that can fly past scanning in the regions.

But it's only when the user clicks the "Update" button that the actual payload gets fetched from an external server or unpacked, which then proceeds to seek the necessary permissions to fulfil its objectives.

"Play Protect may display alerts about the risks, as a part of a different scan, but as long as the user accepts them, the app is installed, and the payload is delivered," ThreatFabric said. "This illustrates a critical gap: Play Protect still allows risky apps through if the user clicks Install anyway, and the malware still slips through the Pilot Program."

One such dropper is RewardDropMiner, which has been found to serve along with spyware payloads a Monero cryptocurrency miner that can be activated remotely. Recent variants of the tool, however, no longer include the miner functionality.

Some of the malicious apps delivered via RewardDropMiner, all targeting users in India, are listed below -

*   PM YOJANA 2025 (com.fluvdp.hrzmkgi)
*   °RTO Challan (com.epr.fnroyex)
*   SBI Online (com.qmwownic.eqmff)
*   Axis Card (com.tolqppj.yqmrlytfzrxa)

Other dropper variants that avoid triggering Play Protect or the Pilot Program include SecuriDropper, Zombinder, BrokewellDropper, HiddenCatDropper, and TiramisuDropper.

When reached for comment, Google told The Hacker News it has not found any apps using these techniques distributed via the Play Store and that it's constantly adding new protections.

"Regardless of where an app comes from – even if it's installed by a 'dropper' app – Google Play Protect helps to keep users safe by automatically checking it for threats," a spokesperson said.

"Protection against these identified malware versions was already in place through Google Play Protect prior to this report. Based on our current detection, no apps containing these versions of this malware have been found on Google Play. We're constantly enhancing our protections to help keep users safe from bad actors."

The development comes as Bitdefender Labs has warned of a new campaign that's using malicious ads on Facebook to peddle a free premium version of the TradingView app for Android to ultimately deploy an improved version of the Brokewell banking trojan to monitor, control, and steal sensitive information from the victim's device.

No less than 75 malicious ads have been run since July 22, 2025, reaching tens of thousands of users in the European Union alone. The Android attack wave is just one part of a larger malvertising operation that has abused Facebook Ads to also target Windows desktops under the guise of various financial and cryptocurrency apps.

"This campaign shows how cybercriminals are fine-tuning their tactics to keep up with user behavior," the Romanian cybersecurity company said. "By targeting mobile users and disguising malware as trusted trading tools, attackers hope to cash in on the growing reliance on crypto apps and financial platforms."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Android Droppers Now Deliver SMS Stealers and Spyware, Not Just Banking Trojans

WhatsApp has patched a vulnerability that was used in conjunction with an Apple vulnerability in zero-click attacks.

WhatsApp says it has issued an update to patch a vulnerability that has been used in conjunction with an Apple vulnerability to target specific users and compromise their devices.

Reportedly, attackers used this exploit against dozens of WhatsApp users, and WhatsApp has notified those affected:

> “Our investigation indicates that a malicious message may have been sent to you through WhatsApp and combined with other vulnerabilities in your device’s operating system to compromise your device and the data it contains, including messages.
> 
>   
> While we don’t know with certainty that your device has been compromised, we wanted to let you know out of an abundance of caution so you can take steps to secure your device and information.”

WhatsApp advised the affected users to perform a full factory reset of their phone in order to make sure they are rid of the malware.

> “We’ve made changes to prevent this specific attack from occurring through WhatsApp. However, your device’s operating system could remain compromised by the malware or targeted in other ways.
> 
>   
> To best protect yourself, we recommend a full device factory reset. We also strongly urge you to keep your devices updated to the latest version of the operating system, and ensure that your WhatsApp app is up to date.”

According to the Amnesty International Security Lab, the vulnerability was part of a zero-click attack against both iPhone and Android users. A zero-click attack is a type of attack which allows the cybercriminals to break into devices or apps without the victim needing to click, tap, or respond to anything. Unlike classic scams that rely on tricking someone into clicking a sketchy link, zero-click threats can land on a device simply because an app receives a message or notification crafted to exploit a hidden flaw.

**Technical details**

The zero-click attack required two vulnerabilities.

For iOS and Mac users these vulnerabilities were tracked as CVE-2025-43300 and lie in the Image I/O framework, the part of macOS and iOS that an app needs to open or save a picture. The problem came from an out-of-bounds write. Apple stepped in and tightened the rules with better bounds checking, closing off the hole so attackers can no longer use it.

An out-of-bounds write vulnerability means that the attacker can manipulate parts of the device’s memory that should be out of their reach. Such a flaw in a program allows it to read or write outside the bounds the program sets, enabling attackers to manipulate other parts of the memory allocated to more critical functions. Attackers can write code to a part of the memory where the system executes it with permissions that the program and user should not have.

In this case, an attacker could construct an image to exploit the vulnerability.  Processing such a malicious image file would result in memory corruption. Attackers can exploit memory corruption flaws to crash important processes or execute their own code.

The second vulnerability, CVE-2025-55177 for WhatsApp users, is caused by incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 and could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.

**What to do**

The infection chain described in the security advisories from Apple and WhatsApp relies on two components: an Apple vulnerability (CVE-2025-43300) in the Image I/O framework and a WhatsApp vulnerability (CVE-2025-55177) that allowed the hijacking of devices by synchronizing messages.

Attackers exploited the Apple ImageIO bug via malicious image files, which is dangerous because this core library is used by multiple apps (not just WhatsApp) for opening and previewing pictures. In affected WhatsApp versions for iOS and Mac, the sync message bug could trigger arbitrary URL processing, creating a powerful combo for chaining exploits and compromising devices without any user action.

While Android users were mentioned among potential targets in advanced spyware campaigns reported by Amnesty, the most severe zero-click risk described applies only to Apple devices. For Android, the WhatsApp vulnerability may have exposed users to attacks, but not via the same chained infection vectors. As always, updating WhatsApp and enabling advanced security features (like Google Advanced Protection on Android) is highly recommended. So is using security protection on your devices.

If you’ve received one of the notifications from WhatsApp, we’d advise you to follow the instructions.

**We don’t just report on phone security—we provide it**

Cybersecurity risks should never spread beyond a headline. Keep threats off your mobile devices by downloading Malwarebytes for iOS, and Malwarebytes for Android today.

 WhatsApp fixes vulnerability used in zero-click attacks 

This guide gives step-by-step instructions how how to enable two-step verification for WhatsApp on Android, iOS, and iPadOS

Two step verification is the name Meta uses for what is generally referred to as Two-factor authentication (2FA). 2FA is not fool-proof, but it is one of the best ways to protect your accounts from hackers.

It adds an extra step when logging in, which is a small extra effort for you, but it dramatically boosts your security. WhatsApp 2FA, called Two-Step Verification, requires you to enter a PIN code when registering your phone number on a new device, stopping hackers even if they have your SMS code.

Here’s how to enable 2FA on WhatsApp for Android and iOS.

1.  Open WhatsApp.
2.  Go to **Settings** (you’ll see it if you tap the three dots, usually located in the upper right corner).
3.  Tap **Account**.
4.  Select **Two-step verification**.
5.  Tap **Enable**.
6.  Create a unique 6-digit PIN and confirm it.
7.  Optionally, you can add your email address to recover your PIN if you forget it.
8.  Tap **Save**.

Now, whenever you verify your phone number on WhatsApp and every so often when you open the app, you’ll need the 6-digit PIN.

**How to set up two-step verification for WhatsApp on iPhone or iPad**

1.  Open the WhatsApp app on your iPhone or iPad.
2.  Tap on **Settings** (the gear icon)
3.  Tap on **Account**.
4.  Select **Two-step verification**.
5.  Tap on **Turn on** or **Set up PIN** to begin.
6.  Enter a six-digit PIN of your choice, then enter it again to confirm it.
7.  Optionally, you can add your email address to recover your PIN if you forget it.
8.  Tap **Save** or **Done**.
9.  If you added an email, enter the verification code sent to that email to complete the process.

Now, whenever you verify your phone number on WhatsApp and every so often when you open the app, you’ll need the 6-digit PIN.

****Enable it today if you can****

Even the strongest password isn’t enough on its own. 2FA means a thief must have access to your an additional factor to be able to log in to your account, whether that’s a code on a physical device or a security key. In addition to your password, this makes an account takeover much harder.

We recommend you set up 2FA on all your important accounts, including messaging and social media accounts. Do it today if you get a chance: It only takes a few minutes but can save you from hours or even days of headaches later. It’s currently the best password advice we have.

**We don’t just report on phone security—we provide it**

Cybersecurity risks should never spread beyond a headline. Keep threats off your mobile devices by downloading Malwarebytes for iOS, and Malwarebytes for Android today.

Tag

#android