GoKawiil
Tech News
Google is highlighting that many persistent Android Auto connectivity problems stem not from the phone but from outdated software running on a car's infotainment system. The company recommends restarting the infotainment unit and, for aftermarket head units like Pioneer or Kenwood, checking the manufacturer's website for firmware updates.
Security researchers found that Android's public NAT-T socket-keepalive API allows ordinary apps to send UDP packets directly to a router, bypassing Always-on VPN and 'Block connections without VPN' protections. Tests on a Pixel 8 Pro, Samsung SM-F966B, and Nothing A059, all running Android 16, confirmed that keepalive packets reached the physical gateway outside the VPN tunnel, with one device sustaining a leak for over 24 hours. The root cause traces to changes in Android's startNattKeepaliveWithFd function, where validation checks tying the socket to the caller's VPN policy were added and later removed.
Security researchers found a flaw in Android's network stack that lets any app, without special permissions, send UDP packets through the device's Wi-Fi or cellular hardware that bypass VPN tunnels entirely. This occurs even when the 'Block all connections without VPN' setting is enabled, exposing a user's real IP address. The bug was reported through Google's Vulnerability Reward Program but closed without action, while GrapheneOS says it is working on a fix.
A solo developer running Google Ads for his puzzle app Dayzle discovered that of 56 billed installs over two weeks, only 13 were real users; the rest came from devices sideloading outdated app versions while falsely reporting Google Play as the installer. These fake installs showed zero engagement, spanned dozens of phone models across many states, and appeared to be generated by a bot farm gaming Google's install-based ad optimization.
Anthropic disclosed that between December 2025 and August 2026 it detected and disrupted misuse of its Claude AI models by multiple threat actors, including groups tied to ShinyHunters. One French-speaking member, 'frkoo', ran automated pipelines on AWS servers that downloaded 1.8 million Android APKs, decompiled them, and scanned for hardcoded credentials using TruffleHog, funneling verified findings into a categorized Telegram network. The same actor also harvested GitHub organization emails to obtain access tokens and ran a carding site impersonating French police to sell stolen payment data.
A free application designed to identify and flag suspicious phone calls and messages is being highlighted as a defense against increasingly sophisticated scams. The tool works across both major mobile platforms, giving users a way to screen for fraud attempts before falling victim to them.
Android now lets users move saved passwords and passkeys directly between password managers through a built-in OS process, without exporting unencrypted files. The system automatically detects compatible managers installed on the device and lets users review data before approving the transfer. Google confirmed support for Google Password Manager, 1Password, Bitwarden, and Dashlane, with more apps expected to add compatibility.
Group-IB researchers found that the Chinese-speaking threat group GoldFactory has been abusing Google's Work Profile feature to clone victims' banking apps into isolated, hidden environments where fraud-detection tools can't reach. The campaign, powered by the Gigabud Android Trojan and a cloning tool called Vwork, compromised roughly 1,469 devices and 1,281 logins in Indonesia between February and July, causing nearly $1 million in losses.
Google is rolling out a built-in Android feature that lets users securely transfer both passwords and passkeys directly between credential manager apps, replacing the old method of exporting unencrypted text files or manually recreating passkeys. At launch, the tool supports Google Password Manager, 1Password, Bitwarden, and Dashlane, with other providers able to add support via Android's Credentials Transfer API. Users initiate the process from their new password manager, and Android handles detection, review, and authorization before completing the transfer in seconds.
Google has enabled a new on-device transfer system letting Android users move saved logins between password managers without manually re-entering them. The feature works through an import option within supported apps, currently including Google Password Manager, 1Password, Bitwarden, and Dashlane, provided both apps are installed and synced with credentials.
Security firm Zimperium has identified a new Android malware called Mantax Otax that combines file encryption with data theft, distributed via malicious APKs outside Google Play through phishing lures aimed at Indonesian users. Once installed, it abuses Accessibility permissions to harvest device data, report to a GitHub-hosted command server, and on older Android versions (9 and below) encrypts files, replaces images with ransom notes, and opens a Firebase-hosted chat to negotiate payment. Researchers exploited a misconfigured Firebase server to expose the attackers' actual conversations with victims.
Google rolled out a new Android feature that lets users transfer passwords and passkeys directly between password manager apps without exporting CSV files. The system works by having the new app request an import from the old one, with Android coordinating the transfer so users can review and approve the data before it moves. The feature currently supports Google's own password manager along with Bitwarden, 1Password, and Dashlane, and works on devices running Android 8 or later.