Serbian activists were targeted with zero-click Pegasus and NoviSpy spyware, exposing a major surveillance campaign ahead of elections.

A member of Serbia’s student protest movement had their iPhone infected with NSO Group‘s Pegasus spyware without ever clicking a link or opening a file. The Citizen Lab confirmed the infection in collaboration with the SHARE Foundation, tracing it to an iMessage zero-click exploit and identifying high-confidence indicators of compromise between December 2025 and January 2026, with the possibility of additional infections not ruled out.

“In collaboration with the SHARE Foundation, the Citizen Lab analyzed forensic artefacts from the iPhone of a member of Serbia’s student protest movement after they received an Apple Threat Notification warning of targeting with mercenary spyware.” reads the report published by Citizen Lab. “Our analysis confirmed that an iMessage zero-click exploit was used to infect the device with NSO Group’s Pegasus spyware. “

The attack required no action from the victim, which makes zero-click attacks especially dangerous. Citizen Lab said the Pegasus infection could stay hidden while giving the attacker full access to the phone, including messages, photos, notes, microphone, and camera. Apple later fixed this specific exploit through security updates in iOS 18.4.1.

“We believe that the zero-click exploit used in this attack targeted Apple iMessage, and has subsequently been patched by Apple as of iOS 18.4.1.” continues the report. “A zero-click infection with Pegasus spyware would not have been visible to the target, and would give the Pegasus attacker total access to the device. Pegasus allows an attacker to do anything that a user can do, ranging from accessing private data like notes, pictures and even encrypted messages. Pegasus also has the ability to covertly enable the phone’s microphone and camera.”

This one confirmed infection sits inside something considerably bigger. The SHARE Foundation has documented at least 14 individuals targeted with advanced spyware since early 2026, spanning student movement members, civil society activists, an opposition member of parliament, and a local councilor, which the organization is calling the largest documented surveillance wave in Serbia’s history. Twelve people approached SHARE’s digital forensics team in August after receiving Apple’s own threat notifications, warnings the company sends when it detects likely state-sponsored spyware targeting; eleven of those devices remain presumed infected pending further forensic confirmation.

The timing lines up uncomfortably well with Serbia’s political calendar. This surveillance wave coincides with local elections held on March 29, 2026, and stretches toward planned early parliamentary elections in October, following months of student-led anti-government and anti-corruption protests.

“These notifications and forensic confirmation highlight the aggressive mercenary spyware targeting of the peaceful pro-democracy movement with mercenary spyware ahead of key 2026 election cycles.” continues the report.

Targeting activists and opposition figures specifically in the run-up to elections isn’t subtle, and it fits a pattern Serbia has shown before.

Serbia has a history of using commercial spyware. Citizen Lab previously documented Pegasus targeting civil society and the use of Cellebrite tools to install the locally developed NoviSpy on activists’ phones. In this case, SHARE Foundation and Amnesty Tech found a new version of NoviSpy on a student activist’s Android phone after Serbian authorities seized it during police questioning.

Amnesty International’s Security Lab head, Donncha Ó Cearbhaill, connected the dots plainly between state custody and spyware installation.

“The forensic findings by SHARE prove that Serbian students continue to be targeted with invasive Android spyware tools, installed while detained by Serbian authorities” he said.

If you’ve received an Apple Threat Notification, whether in Serbia or anywhere else, the Citizen Lab’s guidance is unambiguous: treat it as a presumed infection and get expert help immediately rather than waiting to see if anything seems wrong. Individuals in Serbia should contact the SHARE Foundation directly, and anyone elsewhere can reach Access Now’s Digital Security Helpline, which supports journalists, human rights defenders, and other high-risk civil society targets worldwide. Anyone who suspects they might be a target based on their work or public role should also turn on Lockdown Mode, Apple’s built-in feature that significantly narrows what a zero-click exploit can actually reach, and keep every device updated, since the patch that closed this specific hole has already existed for well over a year for anyone who installed it.

“We believe that the zero-click used in this attack has been rendered ineffective by a patch from Apple in recent iOS versions. We urge everyone, especially those facing increased risks because of who they are or the work they do, to keep all devices updated.” concludes the report. “Click HERE for instructions on how to keep your iPhone up to date.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Pegasus)

Google is introducing new network security protections in Android 17 to strengthen connection privacy, address cellular vulnerabilities, and protect the privacy of users' home networks. [...]

Cybercriminals used to hacking home routers and security cameras have found another Internet-connected device to add to their botnets: your car, according to research published by Kaspersky Lab.

The post Malware Takes the Wheel: Kaspersky Finds First Car Head Unit-Specific Attack appeared first on The Security Ledger with Paul F. Roberts.

The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands. [...]

Google’s new Android verification flow adds a 24-hour wait for apps from unverified developers as broader identity checks approach.

The post Google Tightens Android Sideloading: Unverified Apps Now Face a 24-Hour Wait appeared first on TechRepublic.

Manic Android malware combines banking fraud and spyware, using a Bluetooth relay to steal data even when devices are offline.

ThreatFabric’s Mobile Threat Intelligence team has identified a new Android malware, dubbed Manic, which has been active in the wild since at least February 2026. The researchers state that the malware is still under development as of July.

“Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud capabilities with broader surveillance and device-control features.” reads the report published by the ThreatFabric’s Mobile Threat Intelligence team. “Its targeting is strongly focused on Ukraine, covering Ukrainian banks, government and identity services, and messaging applications, while also extending to Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications.”

The malware monitors 169 different Android apps, including banking and payment apps across several European countries, government and eID services, crypto exchanges and wallets, 2FA tools, messaging apps, browsers and email clients.

This wide coverage appears deliberate. By targeting both financial and communication apps, the attackers can track a victim’s money, messages, location and files from the same device.

ThreatFabric traces the first infrastructure registrations back to February 2026, with development and production services appearing in late March and April. By July, an updated build had added stronger anti-analysis checks, in-memory DEX loading, and a technique the researchers call lock-secret phishing, which extracts the device PIN or pattern by presenting a fake prompt before the victim reaches the real lock screen.

Once installed, Manic requests Accessibility and notification access, then uses the Accessibility service as a UI keylogger. It classifies everything it captures before logging it: lock-screen input, recovery phrase candidates, four-to-six-digit SMS codes, passwords, long messages, email logins, and ordinary text.

“Manic uses its Accessibility service as a UI keylogger. It classifies captured text before recording it, distinguishing lock-screen input, recovery-phrase candidates, four- to six-digit SMS codes, passwords, long messages, email logins, and ordinary text.” continues the report. “Each key log record includes the app and package, captured text, timestamp, whether the input came from Autofill or manual entry, and whether the app is on Manic’s target list “

Each log record includes the app name and package, the captured text, a timestamp, whether input came from autofill or manual entry, and whether the app is on Manic’s target list.

The PIN theft technique works differently from a typical banking overlay. When Manic detects a numeric keypad in a targeted app, it places an invisible layer over the keys and records each tap. It then briefly passes the tap to the real keypad using Android’s Accessibility features, so the banking app works normally while Manic captures the PIN.

Another function, called autoEnterPin, can try to enter a stored PIN or pattern on the Android lock screen. This gives attackers two options: capture a PIN during a banking session and later use it to unlock the device without the victim being present.

According to the researchers, Manic stands out for its offline relay.

“Manic uses a store-and-forward relay mechanism to exfiltrate data even when the infected device cannot reach the C2 server directly.” continues the report. “Collected files and command results are encrypted with AES-GCM and placed in a local queue, allowing the source device to remain offline while the malware searches for another infected device that can provide a route to the C2 infrastructure.”

Manic searches for nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, and supports chains of up to four relay hops. Cutting an infected phone off from the Internet doesn’t cut it off from exfiltration, as long as another infected device is within radio range. It’s a store-and-forward mesh built out of other people’s compromised phones.

Manic gives attackers remote control of the device through WebRTC, allowing them to view the screen and interact with it using Android’s Accessibility features. It can hide its activity with black screens, fake screens or fake update messages, while also covering permission requests.

The July version goes a step further by removing itself from the device’s app launcher. This keeps it out of the normal app list and lets attackers activate it through its wrapper or a deep link.

For defenders, the combination here is complete in an uncomfortable way: credential theft, live screen monitoring, authentication interception, device takeover, and an exfiltration path that doesn’t require the infected device to have Internet access at all. Monitoring for unusual Accessibility service grants and unexpected Bluetooth or Wi-Fi Direct connections from phones that aren’t actively transferring files are the most practical detection starting points.

“Manic is an evolving Android fraud platform designed for Device Takeover (DTO), combining credential and authentication theft with live screen monitoring and remote control. Its targeting spans banks, payment and cryptocurrency services, eID applications, and messengers, with a strong focus on Ukraine.” concludes the report. “A particularly distinctive capability is its offline mesh relay, which allows collected data to move through nearby infected devices over Wi-Fi Direct or Bluetooth when direct C2 access is unavailable. “

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Android Malware)

Android 17 QPR2 Beta 3 adds Pixel customization tools, call-forwarding scam protections, and experimental cellular security features.

The post Android 17 QPR2 Beta 3: Google Adds Customization and New Scam Defenses appeared first on TechRepublic.

A new Android malware named Manic targeting users in multiple European countries has a fallback data exfiltration mechanism that uses nearby infected devices. [...]

Apple sent a new wave of mercenary spyware threat notifications to targeted users in 110 countries, while making the warnings more visible on iPhones. The alerts signal suspected targeting, not confirmed compromise, and Apple is urging affected users to verify the warning, consider Lockdown Mode, and seek expert help.

The post Apple Warns Users in 110 Countries of Mercenary Spyware as iPhone Alerts Get Harder to Miss appeared first on TechRepublic.

Apple warns users of credible, targeted attacks and urges immediate verification, stronger protections, and expert assistance.

Apple has sent a new round of threat notifications to users it believes may have been singled out by mercenary spyware. The company told TechCrunch the latest alerts reached people in 110 countries, adding to notifications it has already issued in more than 150 countries since the programme began in 2021.

“Apple threat notifications are designed to inform and assist users who may have been individually targeted by mercenary spyware attacks, likely because of who they are or what they do. Such attacks are vastly more sophisticated than regular cybercriminal activity, as mercenary spyware attackers apply exceptional resources to target a very small number of specific individuals and their devices.” reads the alert. “Mercenary spyware attacks cost millions of dollars and often have a short shelf life, making them much harder to detect and prevent. The vast majority of users will never be targeted by such attacks.”

That alone should reset the usual mental model. This isn’t about a suspicious app, a recycled phishing email, or the kind of opportunistic malware that lands wherever it can. Apple’s alerts concern highly targeted attacks against particular people, often because of their role, their work, or the people they know.

The people most likely to receive these notifications include journalists, activists, politicians, diplomats, lawyers, and others whose devices may hold valuable conversations, contacts, documents, or location data. That does not mean every recipient has been fully compromised, but it does mean Apple has observed enough to treat the risk as credible.

Apple has also changed how it delivers those alerts. A recipient may see a push notification directly on the iPhone lock screen and in Settings, receive an email from threat-notifications@email.apple.com, and find a warning banner after signing in to their Apple Account. The company says genuine notices will never ask users to click a link, open a file, install a profile, or provide a password or verification code by email or phone.

“Apple relies solely on internal threat-intelligence information and investigations to detect such attacks. Although our investigations can never achieve absolute certainty, Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously.” continues the report. “We are unable to provide information about what causes us to issue threat notifications, as that may help mercenary spyware attackers adapt their behavior to evade detection in the future.”

That lack of detail can frustrate recipients. They want to know who targeted them, how the device was approached, and whether the attacker got in. Apple can’t safely answer most of those questions in public, because publishing the detection logic would give spyware vendors a free quality-assurance report. Nobody needs to make Pegasus-style operators more efficient.

If you receive the warning, don’t panic and don’t start improvising. First, verify it by signing in directly at account.apple.com: a genuine Apple threat notification appears at the top of the page. Then preserve the device, avoid unnecessary resets or changes until you have spoken to someone qualified, and seek expert help, such as the Digital Security Helpline run by Access Now.

Apple recommends enabling Lockdown Mode, its high-security setting designed to reduce the attack surface available to sophisticated spyware. It also advises keeping devices updated, using a strong passcode with Touch ID or Face ID, turning on two-factor authentication, enabling Stolen Device Protection, using strong and unique passwords or passkeys, installing apps only through the App Store, and treating unexpected links or attachments as hostile until proven otherwise.

“Since 2021, we have sent Apple threat notifications multiple times a year as we have detected these attacks, and to date we have notified users in over 150 countries in total. The extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today.” states the alert. “As a result, Apple does not attribute the attacks or resulting threat notifications to any specific attackers or geographical regions.”

The wider value of these alerts goes beyond the device in front of the recipient. Citizen Lab researcher John Scott-Railton told TechCrunch that notifications can reveal that an entire community is being targeted, because people who receive them often seek help and their cases lead investigators to others.

Most people will never receive one of these warnings. Apple says that plainly, and it is worth repeating because not every cybersecurity story needs to become a universal panic. But if your phone shows an Apple notice saying it detected a targeted mercenary spyware attack, assume it matters until an expert tells you otherwise.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Apple)

Google’s tap-to-share Quick Share feature is coming to the Galaxy Z Fold 8 and Fold 8 Ultra, adding a faster proximity-based sharing option for personal and managed devices.

The post Galaxy Z Fold 8 Is Getting Android’s New Tap-to-Share Quick Share Feature appeared first on TechRepublic.

A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal live card data and send it to attackers in real time. [...]

Samsung’s August 2026 Galaxy update fixes 56 Android and One UI security flaws, including critical vulnerabilities and clipboard access risks.

The post Samsung’s August Update Patches 56 Security Vulnerabilities Across Galaxy Devices appeared first on TechRepublic.

OnePlus 10T security support has ended. Here’s how owners can check their patch level, understand the risks, and decide when to replace the phone.

The post OnePlus 10T Is Out of Security Support: Should You Keep Using Yours? appeared first on TechRepublic.

The OnePlus Nord 6 will receive six years of security updates but only four generations of Android upgrades. Here’s how that split could affect app compatibility, device management, and long-term purchasing decisions.

The post OnePlus Nord 6 Gets Six Years of Security Updates, Four Android Upgrades appeared first on TechRepublic.

Researchers linked the Flying Eagle Android RAT to fake police apps, uncovering 170 servers in a growing cybercrime ecosystem.

Hunt.io researchers and independent journalist NetAskari started with a fraudulent Android app impersonating a Chinese Provincial Public Security Bureau service and ended up mapping a sprawling criminal ecosystem built around a leaked Android RAT framework called Flying Eagle, 飞鹰. The investigation found 170 active servers, two Telegram channels distributing modified versions of the stolen codebase, and a likely successor platform already in version 2 development. Chinese state media had already warned citizens about the fake police app in June 2026. Nobody had yet traced what was behind it.

“Analysis of the malware led to a Telegram channel distributing the source code for an undocumented Android application builder and device control framework called Flying Eagle (飞鹰). Hunt.io researchers pivoted on TLS certificates and panel fingerprints to identify 170 servers running the framework, and uncovered a fractured criminal ecosystem built around its leaked codebase.” reads the report published by Hunt.io. “Flying Eagle combines APK generation and full-featured C2 device management in a single panel, with phishing overlays for financial, adult, and government service apps. The source code was stolen in early 2026, along with nearly 200 customer databases, leading to multiple modified variants circulating across criminal actors”

The leak turned a single commercial RAT into an open toolkit that anyone willing to pay 2,000 USDT for a “fixed” version, or nothing at all for the free Docker release dropped on Telegram in April, could deploy.

The framework is more capable than most MaaS offerings at this price point.

“The APK generation module accepts user-defined lured text, application names, icons, and C2 callback addresses, then builds a signed APK using one of two base templates.” continues the report. “Additional observed templates: Chinese adult streaming services, TikTok, financial applications, and landing pages for public welfare projects that send the number of visits and downloads back to the operator.”

To evade antivirus detection, the builder pads APKs with fake JSON configuration data and encrypts C2 callback URLs using AES-128-CBC with hardcoded cryptographic parameters.

The original class names in the source code tell you exactly what the tool does: RecordPayPassword, LiveKeysStrok, ScreenCaps, Webjector, CameraCap. At build time all of those get replaced with randomized 8-to-14 character strings, so static analysis hits a wall immediately.

Hunt.io identified the broader infrastructure through two independent fingerprints: the AdminPro title that briefly appears before operator branding loads, combined with a consistent HTTP 302 redirect behavior and Strict-Transport-Security header. A separate query for servers still running the default TLS certificate packaged with the Flying Eagle Docker deployment added another 12 unique servers. The pivot that connected the Docker version to a separate Windows XAMPP deployment was a misspelled environment variable, SECRIT_KEY, present in both codebases. Someone left a typo in the source, and it followed every fork.

The two Telegram channels operating around Flying Eagle have different roles. Yx科技 functions as sales and operational support: its first messages were step-by-step instructions for draining Alipay and WeChat accounts, referring to victims as “fish” and offering cash-out services at 20 to 50 percent transaction fees.

The SQLRCE0 Telegram channel, created in February 2026, was among the first to distribute Flying Eagle-related files. Researchers found that its posts indicated a leak of the RAT’s source code, including a chat screenshot between an unidentified actor and the malware developers known as “Flying Eagle Tech.”

“The chat showed a negotiation over access to 189 Feiying server and exfiltrated database, with the unknown party claiming to have compromised customer infrastructure.” continues the report. “SQLRCE0 used the ensuing messages to make multiple fixes to the leaked source code: domain connectivity, WebSocket stability, anti-uninstall features, and more all while assuring users with a money back guarantee that all backdoors had been removed from the code.”

A money-back guarantee on a backdoor-free criminal RAT. The market for this stuff is apparently competitive enough to require customer service.

On June 23, three weeks after Chinese state media published the public safety notice, SQLRCE0 introduced Night Dragon, 夜龙,as an independently developed successor. It’s not a reskin of Flying Eagle: it’s a separate build, currently in version 2 development as of July 12. Night Dragon adds a black-screen mode that shows a fake system update to hide operator activity, automatic icon hiding after installation, and single-click credential capture overlays for Alipay, WeChat, ICBC, Construction Bank, Agricultural Bank, and cryptocurrency wallets TokenPocket and imToken.

Hunt.io found one exposed Night Dragon panel showing 46 devices online with 29 actively connected, all geolocated in China. Whether those are real victims or test data is unverified. The operator account names translate to variants of “get rich,” which at least makes the intent clear.

“The device control interface provides full remote access including live screen viewing, SMS and photo gallery access, audio recording, camera capture, and file management. A phishing overlay system allows operators to deploy credential capture prompts for specific applications, with single-click shortcuts for Alipay, WeChat, and major Chinese banks including ICBC, Construction Bank, and Agricultural Bank, in addition to cryptocurrency wallets TokenPocket and imToken.” concludes the report. “Night Dragon represents an evolution beyond the variants of Flying Eagle. Where Yx Technology and SQLRCE0 both distributed modified versions of an existing codebase, this project appears to be an independent build, which is currently in active version 2 development as of July 12th. Its emergence just three weeks after the public safety notice suggests the demand for Chinese-language Android RAT tooling continues to drive criminal actors even as existing platforms are exposed.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Flying Eagle)

Analysis found eSIM Plus and Nicegram share a Belarus-linked codebase, while eSIM Plus routes data and calls through Russian services.

Two popular apps available in EU app stores, Nicegram, with over 50 million downloads, and eSIM Plus, with over 1 million, are presented to users as Lithuanian products. The Mysterium VPN Research Team pulled apart both Android packages to see what the binaries themselves reveal, following OCCRP reporting that both apps are allegedly developed and controlled from Belarus. What they found in the code substantially corroborates that reporting.

“Most decisively, the eSIM Plus package is cryptographically signed by “Mobyrix, Minsk” (a Belarusian signature on an app marketed under the Lithuanian “Appvillis” brand), and it ships live integrations with two Russian services, Yandex AppMetrica (analytics) and Voximplant (call routing, via a .ru endpoint).” reads the report published by Mysterium VPN Research Team. “Nicegram shares the same “Appvillis” codebase and backend, though the specific Russian SDKs aren’t present in the Nicegram build we examined.”

	eSIM Plus 4.4.26	Nicegram 1.55.0
Signing certificate	Mobyrix, Minsk, Belarus (original key)	Google Play re-sign (developer identity hidden)
Yandex AppMetrica	Yes — full SDK (yandex.net, appmetrica.io)	No SDK present
Voximplant	Yes — full SDK (.ru balancer)	No
Location	Fine + coarse, tracking wired	Fine + coarse + background
Other telephony	Twilio	N/A
Analytics/CDP	AppMetrica, Mixpanel, Segment, Customer.io, AppsFlyer, Facebook, Firebase, Qonversion	Firebase, Adjust, Qonversion, AdMob, AppsFlyer
Notable extras	Payment SDKs	Crypto wallet (seed phrases), “God’s Eye” profiling

The signing certificate is the most decisive piece of evidence. It carries the Minsk postal code 220020. An app publicly presented under a Lithuanian-facing brand is cryptographically signed by a company in Belarus, not by inference, but directly from the certificate.

The Russian integrations in eSIM Plus are both confirmed and live. Yandex AppMetrica is fully wired in with around 2,900 code references, communicating with Yandex infrastructure at startup and reporting events to appmetrica.io. AppMetrica derives client IP server-side by design, and location tracking is enabled.

“eSIM Plus integrates the Voximplant calling SDK across a full call stack (VoximplantCallManager, VoximplantIncomingCallService, and related classes, ~1,700 references). It routes through balancer.root.voximplant.ru — a Russian (.ru) endpoint — under the account appvillis.n8.voximplant.com. (Confirmed.)” continues the report. “These are the two specific “leads to Russia” technical indicators named in the reporting, and both are genuinely present and wired to live production hosts.”

In other words, a user making a call through eSIM Plus is routing that call through Russian infrastructure, with no indication of this in the store listing.

The data collection surface on eSIM Plus is unusually wide even by the standards of free apps. It requests 35 permissions including fine and coarse location, contacts, camera, microphone, and telephony. On top of AppMetrica it carries Mixpanel, Segment, Customer.io, AppsFlyer, Facebook SDK, Firebase, and Qonversion, plus payment SDKs and a second telephony vendor. Nicegram’s data collection footprint is similarly broad — 73 declared permissions including background location, camera, and phone identity — and it additionally bundles a non-custodial crypto wallet with seed-phrase handling and a module the researchers call “God’s Eye” that profiles Telegram users’ activity patterns by sending channel and session data to Nicegram’s servers.

“the Nicegram 1.55.0 package we examined does not contain the Yandex AppMetrica SDK, does not contain Voximplant, and contains no .by endpoints or Mobyrix strings.”continues the report. “The only Russian-hosted domains reachable from Nicegram are static-maps.yandex.ru (an optional map-tile provider inherited from upstream Telegram) and coub.com (a media-embed service) — both benign, user-action-gated, and not telemetry channels. “

The Russian-SDK evidence is in eSIM Plus, not in this specific Nicegram build. The two apps corroborate the shared-developer claim; eSIM Plus is where the Belarusian signature and Russian data flows are direct and technical.

The structural problem this research exposes is straightforward. A user in the EU installs an app that presents as Lithuanian and unknowingly routes their identifiers, location, and voice calls through analytics and telephony services in Russia, built and signed by a company in Minsk. Nothing in the store listing told them this. The trust was assumed; the reality was only recoverable by pulling the binary apart. That gap — between what an app’s label says and what the package itself contains — is invisible at install time and only legible to someone willing to do a static teardown. Most users aren’t, and shouldn’t have to be.

“For users, the practical takeaway is that an app’s store-listed “publisher” and country can differ materially from who actually builds, signs, and receives data from the software — a gap that’s invisible in the store listing but legible in the package itself.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, eSIM Plus)

Google added selfie video recovery for eligible accounts, using encrypted videos and liveness checks to help users regain access when locked out.

The post Google Adds Selfie Video Sign-In to Help Users Recover Locked Accounts appeared first on TechRepublic.

The FCC has proposed requiring identity verification for phone activation, a move supporters say will fight fraud while critics warn it threatens privacy.

The post New FCC Proposal Pits Phone Privacy Against Fraud Prevention appeared first on TechRepublic.

Apple is warning iPhone users about FaceTime scams. Learn how the fraud works, what Apple recommends, and how to report suspicious calls.

The post Apple Warns Millions of iPhone Users: FaceTime Scams Are Spreading appeared first on TechRepublic.