New Android attack can show your texts and Gmail | Tech News

Over the previous few years, Google has bought significantly better at offering common security updates to its Pixel telephones, and different Android producers together with Samsung have additionally improved the size of time gadgets get updates for after release.

Despite the more frequent fixes going out to telephones when bugs are discovered, it does not stop criminals from exploiting flaws in Android to seek out new methods to hack telephones and steal your personal knowledge.

A new sort of attack concentrating on Android telephones has been found which can allegedly steal info from your cellphone akin to two-factor authentication codes and your location data, all in much less than 30 seconds.

Researchers from the University of California who found this call it ‘pixnapping’, as a result of the attack, by way of a malicious Android app, kidnaps pixels from your screen, basically that means somebody can see what’s on your screen.

“Pixnapping is a new class of attacks that allows a malicious Android app to stealthily leak information displayed by other Android apps or arbitrary websites,” they mentioned. “Pixnapping exploits Android APIs and a hardware side channel that affects nearly all modern Android devices.”

The researchers mentioned they’ve seen the assaults occur on Google Pixel and Samsung Galaxy telephones, with knowledge having the ability to be scraped (with out the consumer realising) from apps akin to Gmail and even non-public messaging app Signal. The particular telephones had been the Google Pixel 6, Google Pixel 7, Google Pixel 8, Google Pixel 9, and Samsung Galaxy S25, however this doesn’t exclude different telephones from being susceptible.

“Notably, our attack against Google Authenticator allows any malicious app to steal 2FA codes in under 30 seconds while hiding the attack from the user,” they mentioned, indicating attackers might steal the very two-factor authentication codes designed to stop people from having the ability to get into your personal accounts even when they know the username and password.

The attack works when an unsuspecting consumer downloads a malicious app. From there, a sneaky API lets attackers know once you’re doing one thing delicate they might wish to view. This is then displayed with none obstructions for the attacker to see.

As that is based mostly on analysis, it’s not recognized if any such apps are out within the wild and being exploited. Instead, this kind of warning is revealed to tell customers and in order that Google would possibly shortly repair the potential flaw in Android earlier than criminals exploit it.

“Anything that is visible when the target app is opened can be stolen by the malicious app using Pixnapping,” the researchers mentioned. “Chat messages, 2FA codes, email messages, etc. are all vulnerable since they are visible.”

They mentioned the best solution to defend your self from this and any potential attack is to “install Android patches as soon as they become available.”

The excellent news is this kind of attack would solely work should you had been tricked into downloading a malicious app within the first place. This can be extremely unlikely to occur should you keep on with downloading solely verified apps from the Google Play Store. But the invention of such a backdoor into Android is worrying, so it’s best to not sideload any apps and to put in system software program updates once they turn into accessible.