Mobile Hacker's banner

Mobile Hacker

@androidmalware2 • 61,294 subscribers

Mobile Offensive Security 🔴 #redteam Android Reverse Engineering | malware analysis

Shorts

BLE spam but for adult toys Using Flipper Zero or nRF Connect app, it is possible to send Bluetooth LE advertisement packets (without being paired) to adult toys in vicinity and make them all vibrate. It is also possible to start Denial of Pleasure by continuously broadcasting the stop packet by 🆆 🅷 🅸 🅳 -𝙒𝙚 𝙃𝙖𝙘𝙠 𝙄𝙣 𝘿𝙞𝙨𝙜𝙪𝙞𝙨𝙚

Sensitive content

BLE spam but for adult toys Using Flipper Zero or nRF Connect app, it is possible to send Bluetooth LE advertisement packets (without being paired) to adult toys in vicinity and make them all vibrate. It is also possible to start Denial of Pleasure by continuously broadcasting the stop packet by 🆆 🅷 🅸 🅳 -𝙒𝙚 𝙃𝙖𝙘𝙠 𝙄𝙣 𝘿𝙞𝙨𝙜𝙪𝙞𝙨𝙚

7,723,529 просмотров

0-days exploited by #Predator spyware were delivered via man-in-the-middle (MITM) attack and 0-click vulnerability against #iOS and #Android In the video below, I demonstrated how an attacker - using just smartphone - can trigger DNS spoofing attack to redirect device on the same wi-fi network to attacker controlled website. Such domain could deliver phishing or 0-day as in the case of Predator's browser exploit

0-days exploited by #Predator spyware were delivered via man-in-the-middle (MITM) attack and 0-click vulnerability against #iOS and #Android In the video below, I demonstrated how an attacker - using just smartphone - can trigger DNS spoofing attack to redirect device on the same wi-fi network to attacker controlled website. Such domain could deliver phishing or 0-day as in the case of Predator's browser exploit

436,371 просмотров

Nice camouflage. This malware is hard to get rid of. Keeps changing its name and icon impersonating apps already installed on the device

Nice camouflage. This malware is hard to get rid of. Keeps changing its name and icon impersonating apps already installed on the device

140,605 просмотров

Include computers into #Bluetooth mesh network for Bitchat app ✅️ More devices = more nodes ✅️ Wider communication range by Kağan IŞILDAK

Include computers into #Bluetooth mesh network for Bitchat app ✅️ More devices = more nodes ✅️ Wider communication range by Kağan IŞILDAK

64,971 просмотров

Smartphones constantly tell nearby devices which WiFi networks you've connected to and want to reconnect automatically. This information is visible for anyone, and anyone can, based on that, create such rogue Wi-fi Access Point to target specific devices. #karma #karmaattack

Smartphones constantly tell nearby devices which WiFi networks you've connected to and want to reconnect automatically. This information is visible for anyone, and anyone can, based on that, create such rogue Wi-fi Access Point to target specific devices. #karma #karmaattack

54,425 просмотров

Finally, some Karma for Cheap Yellow Display 👏 I think it's time to update my old blog

Finally, some Karma for Cheap Yellow Display 👏 I think it's time to update my old blog

33,503 просмотров

Rooting Android: Exploiting Your GPU On Smartphone (CVE-2024-23380) by Eugene Rodionov PoC exploit is not available for download. [slides] #BlackHat

Rooting Android: Exploiting Your GPU On Smartphone (CVE-2024-23380) by Eugene Rodionov PoC exploit is not available for download. [slides] #BlackHat

31,208 просмотров

Stealing authentication token from Basecamp Android app using deep link Vulnerability analysis: via Daniel h1 report:

Stealing authentication token from Basecamp Android app using deep link Vulnerability analysis: via Daniel h1 report:

29,954 просмотров

Videos

Anya Rossi

sweetdream.ai

SweetDream.ai•Sponsored•Livecam

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

Exclusive private shows

1.2k viewers online

Private Show

Join now for exclusive access

Free preview available • Premium content

Flipper Zero alternative in your wallet? Meet the KIISU Available at SAPSAN #KIISU #FlipperZero

Flipper Zero alternative in your wallet? Meet the KIISU Available at SAPSAN #KIISU #FlipperZero

28,753 просмотров • 10 дней назад

A similar tool - Lockphish - is available on GitHub. It is convincing, and a user in a hurry can be easily tricked Lockphish is a tool for phishing the lock screen, designed to grab Windows credentials, Android PIN, and iPhone Passcode using a https link

A similar tool - Lockphish - is available on GitHub. It is convincing, and a user in a hurry can be easily tricked Lockphish is a tool for phishing the lock screen, designed to grab Windows credentials, Android PIN, and iPhone Passcode using a https link

632,190 просмотров • 2 лет назад

How to Install Proxmark3 on the uConsole to clone RFID and NFC tokens I turned my uConsole into a portable RFID research platform by connecting a Proxmark3 Easy In my blog I cover the installation process, firmware setup, and test by reading and dumping MIFARE Classic keys 👇

How to Install Proxmark3 on the uConsole to clone RFID and NFC tokens I turned my uConsole into a portable RFID research platform by connecting a Proxmark3 Easy In my blog I cover the installation process, firmware setup, and test by reading and dumping MIFARE Classic keys 👇

45,301 просмотров • 1 месяц назад

How to Copy and Backup Your RFID Access Cards and NFC Key Fobs with Chameleon Ultra

How to Copy and Backup Your RFID Access Cards and NFC Key Fobs with Chameleon Ultra

36,965 просмотров • 1 месяц назад

Successfuly cloned my room card using Chameleon Ultra within ~30 seconds and retrieving all its keys #ChameleonUltra #mifare #rfid #nfc #defcon

Successfuly cloned my room card using Chameleon Ultra within ~30 seconds and retrieving all its keys #ChameleonUltra #mifare #rfid #nfc #defcon

51,815 просмотров • 2 месяцев назад

New toys just arrived! Today I'm unboxing two new LoRa devices: -ThinkNode M9 -ThinkNode M5

New toys just arrived! Today I'm unboxing two new LoRa devices: -ThinkNode M9 -ThinkNode M5

22,857 просмотров • 27 дней назад

Public WiFi: Quick demo for 2 devices on the same network 1. SSLstrip + DNS change leads to user input interception for HTTPS with HSTS bypass 2. DNS spoofing redirects user to attacker controlled website More in upcoming "NetHunter Hacker XIII: Overall guide to MITM framework"

Public WiFi: Quick demo for 2 devices on the same network 1. SSLstrip + DNS change leads to user input interception for HTTPS with HSTS bypass 2. DNS spoofing redirects user to attacker controlled website More in upcoming "NetHunter Hacker XIII: Overall guide to MITM framework"

542,217 просмотров • 3 лет назад

uConsole arrived - and I've been having way too much fun with it already

uConsole arrived - and I've been having way too much fun with it already

156,274 просмотров • 9 месяцев назад

How to spoof #iOS devices with Bluetooth pairing messages using Android #DoS

How to spoof #iOS devices with Bluetooth pairing messages using Android #DoS

434,231 просмотров • 3 лет назад

How to install #OpenClaw on Android and control it via WhatsApp using automated script #Termux

How to install #OpenClaw on Android and control it via WhatsApp using automated script #Termux

113,627 просмотров • 8 месяцев назад

Your photos can be accessed without unlocking your Android when you receive a #WhatsApp video call This was discovered by Jose Rodriguez and already reported to Meta and Google

Your photos can be accessed without unlocking your Android when you receive a #WhatsApp video call This was discovered by Jose Rodriguez and already reported to Meta and Google

26,207 просмотров • 1 месяц назад

Android 17 root Full chain browser-to-kernel exploit with two 0-day vulnerabilities affecting Firefox before v151.0.2 (CVE-2026-10702) Click on the link -> root Android Discovered by Nebula Security PoC not available. Info:

Android 17 root Full chain browser-to-kernel exploit with two 0-day vulnerabilities affecting Firefox before v151.0.2 (CVE-2026-10702) Click on the link -> root Android Discovered by Nebula Security PoC not available. Info:

53,134 просмотров • 3 месяцев назад

Bruteforcing PIN protection of popular app using $3 ATTINY85 #Arduino Testing all possible PIN combinations (10,000) would take less than 1,5 hours without getting account locked. It is possible coz, PIN is limited only to 4 digits, without biometrics authentication #rubberducky

Bruteforcing PIN protection of popular app using $3 ATTINY85 #Arduino Testing all possible PIN combinations (10,000) would take less than 1,5 hours without getting account locked. It is possible coz, PIN is limited only to 4 digits, without biometrics authentication #rubberducky

356,266 просмотров • 3 лет назад

Chat without internet via Bluetooth using #Bitchat app

Chat without internet via Bluetooth using #Bitchat app

150,622 просмотров • 1 год назад

Can NFC Canary Detect Someone Scanning Your Payment Card? Have you ever wondered whether someone could scan the contactless cards you're carrying without you noticing?

Can NFC Canary Detect Someone Scanning Your Payment Card? Have you ever wondered whether someone could scan the contactless cards you're carrying without you noticing?

23,908 просмотров • 1 месяц назад

uConsole - Ultimate Portable Computer #uConsole is a modular, handheld Linux device designed for makers, developers, and tech enthusiasts who love flexibility and power on the go. Whether you’re coding, hacking, or building IoT projects

uConsole - Ultimate Portable Computer #uConsole is a modular, handheld Linux device designed for makers, developers, and tech enthusiasts who love flexibility and power on the go. Whether you’re coding, hacking, or building IoT projects

92,491 просмотров • 9 месяцев назад

Get external IP address of the user during #Telegram call. Now it works well and returns public instead of local IP

Get external IP address of the user during #Telegram call. Now it works well and returns public instead of local IP

239,340 просмотров • 3 лет назад

Guessing app's PIN using Flipper Zero as #BadUSB This "App Locker" app protects access to user selected apps - in this case, Instagram - using PIN code. It is possible to guess it with unlimited attempts, because the app developers haven't implemented brute-force protection and even timeout after few incorrect entered passwords. The app only allows to set 4 digit PIN. This allows us to try 10,000 PINs with unlimited attempts. After every try is 0.5 second delay. Because of that, it would take us 84 minutes to rotate through all the PIN combinations. ✅If you decide to use such an app lock protector, make sure not to use easy to guess and common passwords. If you are a developer, I advise you to implement a brute-force protection that includes timeout. #FlipperZero #Android #bruteforce

Guessing app's PIN using Flipper Zero as #BadUSB This "App Locker" app protects access to user selected apps - in this case, Instagram - using PIN code. It is possible to guess it with unlimited attempts, because the app developers haven't implemented brute-force protection and even timeout after few incorrect entered passwords. The app only allows to set 4 digit PIN. This allows us to try 10,000 PINs with unlimited attempts. After every try is 0.5 second delay. Because of that, it would take us 84 minutes to rotate through all the PIN combinations. ✅If you decide to use such an app lock protector, make sure not to use easy to guess and common passwords. If you are a developer, I advise you to implement a brute-force protection that includes timeout. #FlipperZero #Android #bruteforce

223,755 просмотров • 3 лет назад

Get the IP address of the user during #Telegram call to obtain geolocation of ISP It might have some bugs since on Android, it returns only local, not external IP

Get the IP address of the user during #Telegram call to obtain geolocation of ISP It might have some bugs since on Android, it returns only local, not external IP

219,532 просмотров • 3 лет назад