"The new attack, named Pixnapping by the team of academic researchers who devised it, requires a victim to first install a malicious app on an Android phone or tablet. The app, which requires no system permissions, can then effectively read data that any other installed app displays on the screen. Pixnapping has been demonstrated on Google Pixel phones and the Samsung Galaxy S25 phone and likely could be modified to work on other models with additional work."
"Pixnapping attacks begin with the malicious app invoking Android programming interfaces that cause the authenticator or other targeted apps to send sensitive information to the device screen. The malicious app then runs graphical operations on individual pixels of interest to the attacker. Pixnapping then exploits a side channel that allows the malicious app to map the pixels at those coordinates to letters, numbers, or shapes."
Pixnapping is a side-channel attack that lets a malicious Android app, requiring no system permissions, extract any information rendered on the device screen. The attack triggers target apps to display sensitive data, then performs fine-grained graphical operations on individual pixels to map coordinates to characters or shapes. Demonstrations include Google Pixel and Samsung Galaxy S25 devices, and variants could target other models. Google issued mitigations, but modified versions can bypass those updates. The attack cannot extract secrets that are never displayed on screen, such as stored keys that are not rendered visually.
Read at Ars Technica
Unable to calculate read time
Collection
[
|
...
]