Google has announced a new set of Android security protections designed to stop mobile scams across calls, text messages, chat apps, web links, and account verification codes.

The update comes as criminals increasingly use spoofed phone numbers, fake bank alerts, phishing pages, remote screen sharing, and AI-generated voices to trick users into giving up money or login details.

Google said its existing AI-powered scam detection tools in Phone by Google and Google Messages already identify more than five million suspected scam calls and texts each month.

The new protections focus on preventing users from reaching the most dangerous stage of a scam. Instead of only blocking known malicious links or spam numbers.

Android will use a mix of on-device AI, cloud-based analysis, privacy protections, and real-time checks to identify suspicious behavior before victims share passwords, payment data, or one-time passcodes.

A key addition is an opt-in Enhanced Protection mode in Google Messages. Google said the setting will roll out in the coming weeks and will activate stronger protections for complex messaging scams.

This includes expanded Scam Detection using Google’s Private AI Compute platform, which allows Gemini models to review the context of a conversation with an unknown sender.

Google Unveils New Android AI Protections

The aim is to spot slow-moving social engineering scams where criminals build trust over several messages before sending a fraudulent request or link. Google said the analysis occurs in an encrypted environment that Google employees cannot access.

Enhanced Protection will also strengthen link checks in Google Messages. Scammers frequently create new phishing domains that have not yet been added to threat blocklists, which can make standard URL filtering less effective.

Google said Gemini Nano, its on-device AI model, will combine real-time web signals with local analysis to assess unfamiliar links before a user opens them.

Android will also show redesigned warnings for links from numbers not saved in the user’s contacts. This provides an extra checkpoint before users visit a potential phishing page.

The company is also expanding scam alerts from Pixel devices to a wider Android ecosystem. Scam Detection in chat notifications can flag suspicious messages from supported chat apps directly in the notification panel, allowing users to see a warning before opening the message.

Google is working with Android device makers to bring the on-device feature to hundreds of millions of additional users later this year.

Google’s update also targets phone-based social engineering scams, particularly cases where criminals persuade victims to share their screen or redirect incoming calls.

Android will now automatically hide login fields and payment screens during active screen-sharing sessions in Chrome and Android WebView. The Protection is designed to stop fraudsters from viewing passwords, card details, and other sensitive information while guiding a victim through a fake support or banking process.

Another major safeguard addresses OTP theft through call forwarding. Threat actors may trick a user into entering a call-forwarding code, redirecting incoming calls containing verification codes to a criminal-controlled number.

Android will block apps from silently enabling call forwarding in the background and warn users before a manually entered MMI forwarding code takes effect.

Security teams can also review related account takeover risks and prevention steps in Cyber Security News coverage of OTP bypass and MFA phishing campaigns and mobile banking malware.

Google is also expanding verified financial calls, a feature built with banks including Banco do Brasil and Itaú Unibanco. The system checks whether the bank’s official app actually initiated a call claiming to come from a bank.

If verification fails, Android can end the call and alert the user. Google said the feature has blocked more than three million spoofed calls involving the two Brazilian banks since its June launch.

The announcement shows mobile security shifting from simple spam filtering to behavior-based fraud prevention. Users should still avoid sharing passwords, card information, recovery codes, or OTPs over calls and messages, even when the caller appears legitimate.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Google Unveils New Android AI Protections to Block Scam Calls, Phishing Links and OTP Theft appeared first on Cyber Security News.

Google automatically verifies phone numbers on Android devices and adds them to every Google account signed in on the Phone. The setting is enabled by default, raising privacy concerns for users who keep personal, work, and secondary accounts separate.

Google’s documentation confirms that the behavior covers both existing accounts and accounts added later. The feature, called Phone number verification, also covers new phone numbers added to a device.

Adding another Google account can link it to numbers already on the Phone, while adding a new number can attach it to accounts already signed in. Users must turn the setting off themselves to stop automatic verification.

According to Google’s support documentation, verification supports account sign-in, account recovery, emergency services, and communication features.

Google and mobile carriers periodically check that numbers still belong to the user. The company notes that carrier charges may apply during this process.

Google Auto-Adds Phone Numbers to Android Accounts

Android Authority reported that users received unexpected emails saying their phone numbers had been verified. Its staff also found automatic verification enabled on their devices.

The publication said Google updated its support page between August and October 2025 to describe the default setting and account-wide linking. That documentation change does not establish an exact rollout date.

For someone using a separate account for public discussions, testing, or other activities, attaching a personal number creates an unwanted connection within Google’s systems. The concern is losing control over which accounts hold that number.

The documentation does not say this makes the number publicly visible to everyone. Google also says verification enables Better sharing on Google, which supports calls, messages, and notifications involving the number.

However, when several accounts are signed in, Better sharing turns on for only one account. This differs from phone number verification, which applies across all signed-in accounts.

This behavior is an account setting, not evidence of a Google account breach. Cybersecurity News previously covered Google’s denial of Gmail breach claims.

Its reporting on Google’s move toward passkeys also highlights the company’s efforts to simplify account access. Open Android Settings, select Google, and open All services. Under Privacy & security, select Phone number verification, then turn off Verify phone numbers automatically. Google says device settings manage this control.

Turning it off does not remove numbers already attached to accounts, according to Android Authority. Open each affected account’s Personal info page, select Contact info, then Phone, and remove unwanted numbers individually. Review how each number is used before changing it, particularly where account recovery is involved.

Some users reported on Reddit that the setting switched back on on its own. Android Authority could not reproduce that behavior, so it remains a user-reported issue rather than a confirmed general fault. Users managing several accounts should review both the device setting and each account’s stored phone numbers.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Google Automatically Adds Your Phone Number to Every Google Account on Your Android Phone appeared first on Cyber Security News.

GitHub Security Lab has disclosed that its open-source AI security agent identified 24 vulnerabilities in Android applications, including flaws that could enable covert location tracking in OsmAnd and account takeover attacks against Wikipedia for Android.

The findings highlight how targeted AI workflows can help researchers uncover complex mobile logic flaws, while still requiring human validation.

The research used the GitHub Security Lab Taskflow Agent, an open-source framework designed to automate and share AI-assisted security research workflows.

Rather than asking a large language model to scan an entire repository with a general prompt, researchers created Android-specific taskflows that broke audits into smaller stages.

One taskflow identifies mobile entry points, such as exported activities, services, broadcast receivers, and deep links. Another taskflow assesses each entry point against Android-focused vulnerability classes, including insecure intents, confused deputy problems, unsafe broadcasts, cross-app scripting, and WebView risks.

This structure helps the AI understand the relevant attack surface in repositories that may contain mobile, web, and desktop code.

GitHub AI Finds 24 Android Vulnerabilities

One of the most serious findings affected OsmAnd, an Android navigation application with more than 10 million downloads. Researchers found that the app’s exported MapActivity accepted security-sensitive intent extras while importing settings.

Because exported Android activities can receive intents from other applications, a malicious app could supply attacker-controlled values such as silent_import, replace, and export_type_list_key.

The vulnerable logic allowed an unprivileged malicious application to silently import and replace OsmAnd settings without alerting the user. An attacker could modify the application’s map-tile source so that map requests were sent to an attacker-controlled server.

By logging tile coordinates, the attacker could infer a victim’s location and movements. The same weakness could also expose routing requests, including route origins and destinations. At the same time, the user continued using the application normally.

GitHub also detailed an account takeover chain in the Wikipedia Android application. The app registers a wikipedia:// deep link handler to open content inside its WebView. However, the hostname validation used an endsWith() check instead of validating the exact trusted domain.

This allowed a malicious domain such as evil-wikipedia.org to satisfy the suffix check because its name ends with wikipedia.org. An attacker could create a malicious webpage containing a crafted deep link and persuade a victim to open it.

The Wikipedia app could then load attacker-controlled content inside its WebView, potentially making the victim believe they were viewing a legitimate Wikipedia page.

A second domain-suffix validation issue in the application’s cookie-handling code made the attack more severe. The flawed check could cause the WebView to provide Wikimedia cookies to the attacker-controlled page.

Researchers said the stolen data could include a username, long-lived authentication token, and session token valid across Wikimedia projects, including Wikipedia, Wikimedia Commons, Wikidata, and Meta. Chaining the two bugs could therefore result in account takeover after a victim taps a single malicious link.

GitHub cautioned that AI-generated findings must not be accepted without expert review. Large language models can identify code patterns and relevant APIs effectively. However, they can also misjudge severity, overlook mitigating behavior, or generate false positives.

Researchers found that requiring the model to build a proof of concept can improve triage, although human testing remains essential.
The Taskflow Agent and Android audit workflows are publicly available.

GitHub said users need a GitHub Copilot license, and audits can consume substantial premium-model requests because medium-sized repositories may take one to two hours and require many tool calls. The results are stored in an SQLite audit_results table for researcher review.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post GitHub AI Security Agent Finds 24 Android Vulnerabilities Including Account Takeover Flaws appeared first on Cyber Security News.

F-Droid has released version 2.0 of its official Android app, delivering its largest client update in a decade. The open-source Android app repository said the release follows more than a year of development and 14 test builds, with a staged rollout planned over the coming weeks.

Unlike a basic visual refresh, F-Droid 2.0 rebuilds major parts of the app with Kotlin and Jetpack Compose. The change modernizes the codebase, aligns the interface more closely with Android’s Material Design patterns, and is intended to make future maintenance, testing, and feature development easier.

The redesigned app reduces its primary navigation to three areas: Discover, Search, and My Apps. Discover now combines app browsing and categories, while My Apps acts as a central area for installed applications, available updates, and potential issues. Settings and Nearby Swap have moved to the top bar, reducing clutter in the main navigation.

F-Droid 2.0 Released

A central focus of F-Droid 2.0 is improved application discovery. The Discover section highlights newly added apps, recently updated apps, and popular downloads from the repository.

Categories have also been expanded beyond broad labels, helping users locate software such as VPNs, firewalls, password managers, launchers, and navigation tools more easily. The Games category has been split into 17 genres.

Search functionality has also received a major upgrade. F-Droid can now search application names, descriptions, categories, and translated text.

The update also improves search support for Chinese, Japanese, and Korean writing systems. Users can apply multiple filters, including category, device compatibility, and anti-features, to narrow results.

For example, a user can search for an action game, limit results to apps compatible with their device, and exclude software that depends on non-free online services. This helps privacy-focused users find applications that better match their technical and licensing requirements.

The release also changes how updates and installations work. F-Droid 2.0 checks for and installs application updates automatically by default, while retaining manual and fine-grained controls for users who prefer them. The previous pull-to-refresh method for checking updates has been moved to the My Apps overflow menu.

F-Droid said Android platform changes, driven in part by the European Union’s Digital Markets Act and antitrust pressure, now enable alternative app stores to provide a smoother installation experience.

The app uses Android’s newer installer capabilities and pre-approval API on supported devices, allowing a user to approve an installation earlier in the process instead of waiting until a download completes.

The project also revised privacy features. Tor configuration has shifted toward generic proxy settings, with Tor VPN presented as the recommended approach for easier use.

The app-hiding feature now changes only the app’s icon and name, clearly signaling that the application can still be discovered in Android settings or during forensic inspection.

However, F-Droid 2.0 does not currently support the F-Droid Privileged Extension, and its panic-trigger app-wiping capability has not yet returned. Users who depend on app wiping for personal safety or privacy may want to delay upgrading until the feature is reassessed.

F-Droid 2.0 significantly modernizes a key free and open-source Android software distribution platform, combining improved discovery, modern Android development practices, and a more streamlined installation workflow.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post F-Droid 2.0 Released After 10 years With Major Redesign to Transform Open-Source Android App Discovery appeared first on Cyber Security News.

Android has released new Security State libraries that allow apps and enterprise tools to check whether a device is missing important security patches.

The update gives developers a more detailed view of Android security than the traditional monthly Security Patch Level, helping apps identify unpatched system components, pending updates, and specific vulnerability fixes.

The stable release includes AndroidX Security State version 1.1.0 and Security State Provider version 1.0.0. These libraries are designed for security-sensitive Android apps, including banking, fintech, healthcare, enterprise mobility, and Mobile Device Management platforms.

Previously, many applications relied on a device’s Security Patch Level, often shown as a single date in Android settings. However, Android devices now receive security updates through several channels.

Android Apps Can Detect Missing Security Patches

System updates may arrive from the device manufacturer, while modular Android components can be updated through Google Play system updates. Kernel fixes may also follow separate Long-Term Support release versions.

Because of this fragmented update model, one patch date does not always show the full security condition of an Android device. The new APIs give applications component-level patch information instead of relying on one broad security date.

Android Security State uses three types of patch levels. The Device Security Patch Level shows the patch version currently installed on the phone.

The Published Security Patch Level shows the latest patch level published in the Android Security Bulletin. The Available Security Patch Level identifies updates already available for download or installation on that specific device.

These checks apply to the Android system, system modules, and the Linux kernel. The system includes the main Android operating system delivered through standard manufacturer over-the-air updates.

System modules cover modular components updated through Google Play system updates under Project Mainline. Kernel status is measured through Long-Term Support kernel versions, such as 5.15.159 or 6.1.91, rather than a monthly patch date.

The new capability could improve how Android apps handle high-risk actions. For example, a banking app can check whether a critical update is pending before allowing a high-value transaction.

An enterprise application can verify whether a company-managed phone meets its required security baseline before granting access to internal services.

If an update is already staged and ready to install, the app can guide the user to Android Settings instead of blocking access immediately.

Developers can also use the libraries for vulnerability-specific checks. This could allow an app to determine whether important vulnerabilities affecting NFC, Bluetooth, or other device functions have been fixed.

A tap-to-pay application could check whether relevant NFC security patches are present before permitting a payment. At the same time, an enterprise tool could evaluate Bluetooth fixes before allowing proximity-based data sharing.

The Security State libraries also connect with Android Security Bulletin data through the Open Source Vulnerabilities database. This enables more accurate patch assessments, including cases where a monthly update does not contain a new fix for a particular component. In such cases, the component can still be recognized as effectively protected.

Android 17 also introduces Supplemental Patches XML support. This lets device manufacturers declare security fixes that were backported before a full monthly Security Patch Level update is issued.

The new libraries can surface those fixes to apps and management platforms, allowing OEMs to receive credit for security remediations immediately.

For update providers, the Security State Provider library establishes a standard method for OTA clients to report available updates through Android’s inter-process communication framework.

Google Play system updates already support this model on Google Mobile Services Android devices. At the same time, Google has also integrated its OTA platform. Android is working with global OEMs to bring their update clients into the same framework.

The release gives developers and enterprises a practical way to detect missing patches, identify pending fixes, and make security decisions based on the real protection status of individual Android device components.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Android Apps Can Now Check If Your Phone Is Missing Critical Security Patches appeared first on Cyber Security News.