Loading story…
Google said it is rolling out a fix for an Android 16 lock-screen bypass in Gemini that allows someone with brief physical access to a locked phone to send SMS and WhatsApp messages without entering a PIN, password, or biometric. Researchers and follow-on reporting said the flaw can be triggered through a specific multi-touch interaction when Gemini is invoked from the lock screen and prompted to open apps such as Messages, bypassing the expected authentication step. Google said the issue is not limited to Pixel devices, though it did not identify all affected manufacturers or models.
The bug was reproduced on a fully patched Pixel 6a and appears tied to Gemini's Deep Research and lock-screen app-handoff behavior, where authentication checks can fail during transitions from the lock-screen overlay into the full app. Reporting said the weakness may also let an attacker regain Gemini access to previously disconnected apps, switch accounts, view or delete Gemini conversation history, change some security settings, and exfiltrate data while leaving no failed unlock attempts logged. The researcher who disclosed the issue said it reflects an incomplete fix for an earlier reported vulnerability and points to a broader trust-boundary problem in how lock-screen restrictions are enforced across Gemini activities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Google said it was aware of the Android 16 Gemini lock-screen bypass bug, had implemented a fix, and planned full deployment during the same week. Reporting said the flaw could let someone with physical access send SMS or WhatsApp messages and regain Gemini access to disconnected apps without completing authentication.
Security researcher Sandiyo Christan reported that a fully patched Pixel 6a running Android 16 could still be subjected to a Gemini-based lock-screen bypass without requiring a PIN, password, or biometric. He described it as an incomplete fix for a previously reported Google VRP issue, with access to sensitive Gemini functions while the device remained locked.
Payatu published a report describing an Android lock-screen bypass involving Google Gemini. This appears to be the earlier technical disclosure of the issue later referenced by reports about an incomplete fix and Google's subsequent rollout of a patch.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourceinfosecwriteups.com
Open sourcepayatu.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SafeBreach disclosed indirect prompt injection attacks against **Google Gemini’s Android voice assistant** that abuse its notification-reading capability to ingest malicious instructions from third-party apps including WhatsApp, Slack, Signal, Instagram, Messenger, and SMS. The researchers said crafted notifications can silently poison Gemini’s conversational context and manipulate responses without the user’s awareness, allowing attackers to present benign-looking content while embedding hidden or obfuscated prompts that the assistant interprets as trusted instructions. SafeBreach said its **Fake Context Alignment** technique bypassed Google’s earlier mitigations by using foreign-language text, muted hyperlinks, and other concealed prompt formats to trick backend authorization logic into treating a victim’s normal reply as approval for sensitive actions. Demonstrated impacts included phishing and social engineering using trusted contact names, smart home control, URL opening, Zoom or other cross-app actions, covert camera streaming, persistent memory poisoning across Google Workspace, and recurring surveillance tasks; Google said classifier improvements deployed after the August 2025 report mitigated the indirect prompt injection and delayed tool invocation scenarios described.
Jul 16, 2026
A newly disclosed side-channel attack, dubbed Pixnapping, has been demonstrated by researchers from several US universities, revealing a significant security vulnerability in Android devices manufactured by Google and Samsung. The Pixnapping technique allows a malicious Android application to covertly extract sensitive on-screen data, including two-factor authentication (2FA) codes, Google Maps timelines, and information from apps such as Signal, Venmo, and Gmail, without requiring any special permissions. The attack leverages a hardware side-channel known as GPU.zip, previously disclosed by some of the same researchers, and exploits Android APIs to force victim pixels into the rendering pipeline. By stacking semi-transparent Android activities, a rogue app can compute on these pixels and reconstruct sensitive information pixel-by-pixel. The researchers successfully demonstrated the attack on Google Pixel models 6 through 9 and the Samsung Galaxy S25, all running Android versions 13 to 16. The attack is notable for its ability to bypass browser-based mitigations and to target both browser and non-browser applications, including Google Authenticator, making it possible to steal 2FA codes in under 30 seconds. The Pixnapping attack does not require the malicious app to request or obtain any special permissions, increasing the risk of exploitation if users are tricked into installing such an app. The technical complexity of the attack is high, requiring deep knowledge of Android internals and graphics hardware, but once developed, the attack could be packaged into seemingly benign apps and distributed through typical malware channels. The researchers disclosed their findings to Google and Samsung in early 2025, prompting Google to issue partial patches, though some workarounds remain and both companies are still working on comprehensive fixes. The underlying methodology of the attack suggests that other Android devices beyond those tested may also be vulnerable, as the exploited APIs and hardware features are common across the platform. The attack highlights the limitations of current Android permission models, as it enables data theft without explicit user consent or awareness. Security experts warn that this vulnerability could be leveraged by sophisticated threat actors to compromise sensitive user data at scale. The research underscores the need for both OS-level and hardware-level mitigations to address such side-channel threats. Users are advised to exercise caution when installing new apps, even from trusted sources, and to stay updated with the latest security patches from device manufacturers. The Pixnapping disclosure has prompted renewed scrutiny of Android's security architecture and the effectiveness of existing app sandboxing and permission controls. Ongoing collaboration between academic researchers and industry vendors is expected to drive further improvements in mobile device security in response to this class of attacks.
Jun 29, 2026
Researchers identified **PromptSpy**, a newly disclosed Android spyware and remote access trojan that uses **Google Gemini** during runtime to interpret on-screen elements and decide which gestures to perform on an infected device. The malware can steal lockscreen PINs and passwords, enumerate installed apps, capture screenshots, record video, and give operators live remote screen control over encrypted communications. Investigators said the AI-assisted navigation appears to be the first reported case of mobile malware directly invoking generative AI on a victim device while executing. PromptSpy was discovered by ESET during an investigation into a separate AI-enabled ransomware case and was distributed through a fake Argentine banking-themed website using app names such as **MorganArg** and **MorganArgs**, impersonating a JPMorgan Chase Argentina branch app. Telemetry indicates limited real-world deployment, with one confirmed detection in Ukraine in February 2026, suggesting the malware may still be an early-stage proof of concept. The spyware abuses Android accessibility services to keep itself pinned in the recent apps list and to hinder removal by placing invisible overlays over the **Stop** and **Uninstall** buttons, while Google Threat Intelligence Group said its Gemini-driven interaction is broader than persistence alone and that components including API keys can be updated remotely through command-and-control.
Jul 9, 2026