Android Pixnapping Flaw Affecting Billions Of Devices Can Steal Your Data & 2FA Codes
Android users beware—a new form of Android malware dubbed Pixnapping has been revealed to the public, and in theory, all current Android devices running Android 13 or newer are vulnerable since "the core mechanisms enabling the attack are typically available in all Android devices." The attack can be leveraged from any running Android app, even if it does not have Android system permissions, and it can steal any visible information from other running apps, including chat messages and 2FA codes.
As the "Pixnapping" name implies, it's effectively "pic-snapping" sensitive information from other running applications to discreetly send back to the attacker, allowing for account hijacking and other security breaches. What's more, it can be executed in under 30 seconds on a modern Android device.
Thankfully, this isn't another remote code execution vulnerability like those addressed in January of this year by Google, but the umbrella of impacted devices is just as wide. Plus, being able to steal all visible information from other running applications is, to say the least, a privacy nightmare.
Like Crocodilus, this one is quite difficult for end users to detect. Fortunately, there is good news—namely, that there are no known examples of Pixnapping attacks being employed by attackers in the wild, and that Google and the like have been aware of the exploit for some time. Why is that good news? It means mean that updates addressing this vulnerability should come in due time. And now that the wider public is aware of the vulnerability, the clock is ticking.
As detailed by the official Pixnapping disclosure page, the attack (or at least an upcoming paper detailing it) was discovered by a variety of researchers from the Universities of Washington, as well as Berkeley, California, San Diego, California and Carnegie Mellon University. These researchers are Riccardo Paccagnella (Carnegie Mellon), Davild Kohlbrenner (Washington), Hovav Shacham (San Diego), Christopher Fletcher (Berkeley), Yingchen Wang (Berkeley), Pranav Gopalkrishnan (Washington), and Alan Wang (Berkeley).
The attack was demonstrated on five devices running Android 13 through 16 and included four Google Pixel phones (6-9) and the Samsung Galaxy S25. But as confirmed by the researchers and previously stated, the mechanisms enabling the attack are typically available in all Android devices, which makes older Android phones and tablets that will never receive updates particularly vulnerable.
Image Credit: Pixnapping.com
