The 2026 Security 360 Mobile report is here!
As part of this yearโs research, #Jamf partnered with NowSecure to analyze 135 widely used mobile apps used in enterprises today.
The analysis, grounded in #OWASP standards, highlights how pervasive app vulnerabilities are.
See the report findings: https://loom.ly/P761XRY
@jamfsoftware #Jamf #MobileSecurity#Cybersecurity #MobileApps
Fake WhatsApp app used to deploy spyware โ ๏ธ
~200 users targeted via sideloaded iOS app linked to SIO surveillance tools.
Mobile threat landscape is evolving fast.
https://www.technadu.com/whatsapp-spyware-alert-fake-app-targets-users-in-italy/624962/
Google clamps down on Android developers with mandatory verification
https://fed.brid.gy/r/https://nerds.xyz/2026/03/android-developer-verification/
Day 10 of #100VibeProjects ๐
Built a local web tool that does static security analysis of Android APKs โ upload an APK and get a report covering permissions, hardcoded secrets, SDK fingerprinting, cert pinning, and crypto posture.
The interesting part: the methodology came from reverse-engineering the WhiteHouse app teardown that went viral last week. Applied the same five-gate analysis framework to a real banking app.
Found an expired certificate pin (silently disables TLS pinning for all users), a session replay SDK with no confirmed masking rules, and four Adobe tracking SDKs doing cross-device user stitching.
The tool runs entirely locally. No data leaves your machine. APK deleted after analysis.
Stack: Python ยท Flask ยท androguard ยท 380 lines
๐ Blog: mrdee.in
https://mrdee.in/writing/vibecoding-day010-offline-apk-security-analyzer/
๐ป GitHub Repo: https://github.com/mr-dinesh/Offline-APK-Analyzer
#VibeCoding #AppSec #AndroidSecurity #MobileSecurity #Python #Flask #DFIR #InfoSec #ReverseEngineering #CyberSecurity
Building an Offline APK Security Analyzer in Flask Project #10 of the 100 Vibe Coding Projects challenge Iโve been doing APK security analysis manually for years โ pulling the file, running jadx, grepping through decompiled source, eyeballing the manifest. It works, but itโs slow and the output lives in a terminal window that disappears the moment you close it. This weekโs project: wrap that entire methodology into a local web tool. Upload an APK, get a structured risk report in your browser. No internet required, nothing stored, APK deleted the moment analysis completes.
Sam Bent reports the White House app v47.0.1 requests 26 Android permissions, including precise location, biometric authentication, storage changes, startup, overlay, and Wi-Fi access, and embeds 3 trackers including Huawei Mobile Services Core. The piece also says the app includes an ICE tip line link and a "Text the President" feature that prefills "Greatest President Ever!" while collecting contact details. More broadly, the article compares permissions and trackers across U.S. government apps including FEMA, myFBI Dashboard, IRS2Go, and CBP Mobile Passport Control and argues many functions could be delivered via the web instead of mobile apps.
https://www.sambent.com/the-white-house-app-has-huawei-spyware-and-an-ice-tip-line/
๐ถ Cyber Tip: Turn off Bluetooth when not in use.
Disabling it reduces the risk of unauthorized connections and device based attacks.
Just Announced for BSides Luxembourg 2026!
Lightning Talk โก ๐จ๐ก๐๐๐ฅ๐ฆ๐ง๐๐ก๐๐๐ก๐ ๐ ๐ข๐๐๐๐ ๐ฆ๐ง๐๐๐๐๐ฅ๐ช๐๐ฅ๐ - ๐๐๐ข๐จ๐๐ก ๐ฅ๐๐๐๐จ๐ง
Elouan Rigaut https://linkedin.com/in/elouan-rigaut is a security researcher focused on mobile threats and surveillance technologies. His work examines stalkerware, attacker behavior, and detection challenges, with an emphasis on real-world impact and emerging research gaps.
๐
Conference Dates: 6โ8 May 2026 | 09:00โ18:00
๐ 14, Porte de France, Esch-sur-Alzette, Luxembourg
๐๏ธ Tickets: https:// 2026.bsides.lu/tickets/
๐
Schedule Link: https://pretalx.com/bsidesluxembourg-2026/schedule/
#BsidesLuxembourg #CyberSecurity #MobileSecurity #Privacy #Stalkerware #InfoSec
๐ Cyber Tip: Enable biometric logins on mobile devices.
Fingerprint or facial recognition adds an extra layer of protection if your device is lost or stolen.
For the first time ever, OWASP MAScon hits OWASP Global AppSec EU 2026 in Vienna! Join top experts for cutting-edge mobile security talks, live demos & real-world insights.
๐ Tickets: https://owasp.glueup.com/event/owasp-global-appsec-eu-2026-vienna-austria-162243/tickets.html
๐ Details: https://owaspglobalappseceuvienna20.sched.com/overview/type/MobileAppSecCon
The DarkSword iOS exploit, targeting Safari and WebKit, has leaked publicly on GitHub. โ ๏ธ
Apple patched affected devices with iOS 26.3, 18.7.3, 16.7.15, and 15.8.7, but unpatched devices remain at risk. ๐
#TechNews #iOS #MobileSecurity #Privacy #FOSS #OpenSource #UserControl #SoftwareUpdate #CyberSecurity #Exploit #Patch #UpdateNow #iPhone #iPad #SecurityAlert #DarkSword #Hacking #Safari #WebKit #GitHub
NowSecure
TechNadu
NERDS.xyz โ Real Tech News for Real Nerds
๐ฏ๐๐๐๐๐ ๐ฎ๐ณ
TechnoTenshi 
Zevonix
BSidesLuxembourg
OWASP Foundation
knoppix