DIGITAL LIFE

Scary Android GhostMap Exploit traps devices in permanent Boot Loop

The folks at Bitdefender have discovered a new type of malicious Android app that can force a phone into a nigh-unfixable boot loop without the app even being launched. 

If the app is installation is kicked off and either Android 17 or a third-party security scanner doesn't catch it and prevent the installation from completing, at this point in there is effectively no recourse without resorting to a factory reset or (possibly) a targeted removal via the Android Debug Bridge (ADB.)

Despite the apparent severity of the issue, Google considers it "outside the scope of a security update fix," though it has forwarded the finding to its engineers for possible inclusion in a future Android update. 

Fortunately, this shouldn't be an unfixable problem for either Google or end users who wound up infected. GhostMap is a parser differential vulnerability exploit, and Android has been under attack by exploits like this for more than a decade, per Bitdefender. And unlike SMS of Death, for which there is no defense beyond a new number, new phone, or a patch that may not come, app scanners like Bitdefender's own Bitdefender Mobile Security can catch applications like these.

So, if you get struck by GhostMap, what can you do? Bitdefender points out that a factory reset would fix the issue, but since the problem is a malicious app, skilled users of ADB on an impacted device should be able to remove the app and fix the problem as well.  

As long as you know which app caused the problem, ADB can be used on your boot-looping phone in Recovery Mode to remove the application, per these instructions. There's no guarantee that fix will work, but it's a step worth trying before nuking your phone entirely with a factory reset. 

After installation, a core system process crashes, restarts, and crashes again, leaving the phone stuck in a boot loop. Restarting doesn't help, and neither does safe mode.  

To get the phone working again, you need a factory reset, which erases the user's data. If, by chance, USB debugging had already been enabled, you could use a computer with ADB (Android Debug Bridge) to delete the file before the phone reboots. 

We began investigating on Aug. 12, 2026, when an APK collected from the wild crashed emulators in our analysis infrastructure. The sample was a banking dropper that never ran and crashed during installation.  

When we looked closer to find out why, we found the problem wasn't the malware—it was the Android itself. The operating system mishandles two fields inside a ZIP entry, the compression method and the declared uncompressed length. Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file.  

We call it GhostMap: the malformed entry causes Android to map the file across memory that was never allocated, and the crash occurs when a process reads from that empty space. 

Based on our testing, we consider the risk posed by this bug to be significant. In theory, an attacker could hide this technique in a fake app to disable a victim’s phone, or use the threat of a factory reset and data loss as leverage for extortion. Malformed APKs could also disrupt tools that inspect Android applications. We have not observed any of these scenarios in the wild. 

Key findings:

An app you never open can render your phone unusable. Simply installing the crafted app is enough to trigger the crash loop. It requests no permissions and contains no executable code.

Restarting the phone doesn’t solve the problem. The crash loop persists after a reboot and continues in safe mode. Restoring the phone may require a factory reset, which erases locally stored data.

Running on the latest Android version. Researchers reproduced the failure on a Pixel 10 running Android 17 with the Aug. 5, 2026 security patch. It affects all Android versions from Android 10 and above.

The discovery began with an APK found in the wild. It crashed Bitdefender’s analysis emulators, prompting the investigation. Researchers later developed a demonstration of the persistent crash loop.

Google assessed the issue as outside the scope of a security fix. Bitdefender reported the findings on Aug. 20 and Aug. 25, 2026. According to Google’s second response, the issue will not be addressed through a security update and was referred to a feature team for possible consideration in a future version.

The banking dropper was wrapped by a packer. This is a tool that rewrites an APK's internal structure so reverse-engineering tools can't read it. It’s very common in modern Android malware.  

In this case, the same rewrite also broke the Android component that parses an app during installation. That’s why the installation crashed in the first place and why our emulators failed on it. The good news is that nothing in the sample suggests the author knew the file would crash anything. 

The sample did no more than that—a failed install. The underlying flaw runs deeper. We found that the same mistake can be aimed at a core system service instead of the installer, and there it produces the repeating crash loop described above, with no way back except a factory reset. That escalation is our own work; we have not seen it used against anyone. 

The underlying problem concerns how Android trusts size and compression information in APK files, and it’s not limited to malformed ZIP files. 

Disclosure timeline and Google’s response...We reported the issue to Google twice through the Android & Devices Vulnerability Reward Program, expanding the second submission after further testing confirmed a persistent system crash loop. 

August 12, 2026 — Initial discovery. An APK collected from the wild crashed emulators in our analysis infrastructure during installation. Our investigation traced the failure to Android’s handling of ZIP entry compression methods and declared uncompressed length.  

We also found that applications using Android’s native APIs to parse APKs could crash when reading them. 

We reproduced the bug and made more discoveries. Every attempt to install that APK crashed the OS and caused a reboot: 

-If the file was parsed as an APK by third-party apps using Android's native APIs (including our BMS), the parsing process crashed. 

-The file couldn’t be deleted without ADB (Android Debug Bridge), not even in safe mode, because file-manager processes crashed when they tried to parse it. 

The file couldn’t be deleted without ADB (Android Debug Bridge), not even in safe mode, because file-manager processes crashed when they tried to parse it. 

 Aug. 20, 2026 — First report to Google. We submitted these findings, documenting installation-triggered crashes and failures in applications parsing the malformed APK. Google closed the report shortly afterwards with the status Won’t Fix (Not Reproducible). Its accompanying response described the submission as outside the program’s scope. 

Further investigation — Persistent denial of service. We continued testing and found an APK that installed successfully but caused a system service to crash when it automatically read an application resource. The resulting crash loop prevented access to the interface and continued in safe mode. Recovery could require a factory reset. 

We started investigating further after that. We found that we could also malform other files that are not parsed at install time, and that some Android system services try to parse them automatically. This meant the loop followed the regular path: crash, reboot, parse again, and then get stuck in a boot loop once more. 

The boot loop we caused would also disable safe-mode access, and the only recovery methods we identified were a factory reset or, in limited conditions, ADB-based scripts racing with the system-server crashes. 

The GhostMap vulnerability, detailed by Bitdefender Labs, affects Android devices (version 10 and later) and causes the device to enter an infinite reboot loop immediately after the installation of a malicious APK package.

Key characteristics of the flaw:

• Attack mechanism: Android misinterprets ZIP compression fields within installation packages, triggering a hardware/memory error (SIGBUS) that crashes the essential `system_server` process.

• No permissions required: The application does not request special permissions, nor does it need to be opened by the user; the mere act of installation triggers the crash.

• Ineffective Safe Mode: The reboot cycle persists even when the phone is started in Safe Mode.

• Google’s response: The flaw was reported by Bitdefender in August 2026, but Google initially deemed the issue outside the scope of an immediate security fix.

How to recover the device:

• Factory reset: This is the only standard solution, though it results in the total loss of all local data not backed up to the cloud.

• Android debug Bridge (ADB): It is possible to remove the problematic file via a computer, provided that USB debugging was already enabled on the device before the incident occurred.

mundophone

 

DIGITAL LIFE

Your next budget phone may come with recycled RAM as memory prices climb

Rising memory costs could bring an unexpected change to smartphone manufacturing: more devices may ship with refurbished RAM. While reballed chips can help manufacturers keep costs down, inconsistent quality could affect reliability and shorten smartphone lifespans.

Smartphone makers are increasingly turning to refurbished memory chips to keep production costs under control as DRAM prices continue to rise, just like we reported last month. So far, these components have mainly been used in entry-level and budget phones, but their adoption is expected to grow further in 2027.

Reballed memory is essentially recycled DRAM: chips recovered from older devices are reprocessed and fitted with new solder balls so they can be used again. Most of the current supply consists of 4 GB LPDDR4X modules, which are mainly used in 4G smartphones priced below $200.

Reusing recovered memory chips gives manufacturers a way to cut component costs and keep their devices affordable despite rising DRAM prices. This is particularly important in the budget segment, where even a small price increase can make a significant difference. According to research firm TrendForce, reballed memory is expected to account for 3–4 % of the smartphone market in 2026. That share could rise to 7–9 % next year.

TrendForce expects DRAM price increases to accelerate further in the first quarter of 2027, adding pressure to smartphone makers’ cost structures. As a result, the use of lower-specification components and reballed memory could gradually extend beyond budget models into higher price segments. TrendForce sees this as a potential cost-management strategy as brands adapt to a prolonged period of elevated memory prices.

Still, reballed memory is unlikely to make a major difference to the overall DRAM market. Even with wider adoption in smartphones, these chips are expected to account for only a small share of total annual LPDRAM bit consumption.

Reballed memory can provide short-term savings and help manufacturers maintain shipment volumes amid rising component costs. However, there are risks for both manufacturers and consumers. TrendForce notes that sourcing refurbished chips is more complicated and their quality can be less consistent. This could affect smartphone reliability and shorten device lifespans, while increasing warranty and repair costs for manufacturers and potentially damaging their reputations.

The cost of lots of the devices we all use could be forced up in 2026 because the price of Ram - once one of the cheapest computer components - has more than doubled since October 2025.

The tech powers everything from smartphones to smart TVs, as well as things like medical devices.

Its price has shot up because of the explosive growth in the data centres which power AI, which need Ram too.

That's caused an imbalance between supply and demand which means everyone has to pay more.

Manufacturers often choose to swallow small cost increases, but big ones tend to get passed on to consumers. And these increases are anything but small.

"We are being quoted costs around 500% higher than they were only a couple of months ago," said Steve Mason, general manager of CyberPowerPC, which builds computers.

He said there "will come a point" where these increased component costs will "force" manufacturers to "make decisions about pricing".

"If it uses memory, or storage, there is the potential for price increases," he said.

"The manufacturers will have choices to make, as will consumers."

Ram - or random access memory - is used to store code while you use a device. It is a critical component of almost every kind of computer.

Without it would be impossible for you to read this article, for example.

And with the component being so ubiquitous, Danny Williams from rival computer building site PCSpecialist said he expected price increases to continue "well into 2026".

"The market has been very buoyant in 2025 and if memory prices do not fall back a little I would expect a reduction in consumer demand in 2026," he said.

He said he'd seen "a varied impact" across different Ram producers.

"Some vendors have larger inventories and therefore their price increases are more subtle at perhaps 1.5x to 2x," he said.

But he said other firms did not have a large amount of stock - and they had increased prices by "up to 5x" more.

"Most of the market intelligence we have received would suggest pricing and supply will be a challenge worldwide throughout 2026 into 2027," Mr Mason said.

And some big firms have turned their nose up at the consumer market altogether.

Micron, previously one of the biggest sellers of Ram, announced in December it would stop selling its Crucial brand to focus on AI demand.

"It removes one of the biggest players from the market," Mr Mason said.

"On the one hand, that's less choice for consumers - on the other hand, if their entire production ploughs into AI, it should free up capacity for the others to make more for consumers, so it may balance out."

Mr Howard said a typical laptop, with 16GB of Ram, could see its manufacturing cost increase by $40 to $50 (£30 to £37) in 2026 - and this "will likely be passed on to consumers".

"Smartphones will also see upwards pressure on their prices," he said.

"A typical smartphone could see its cost to build increase $30 which, again, will likely get passed on directly to consumer."

And Mr Williams said there might be another outcome of increased prices too.

Profit margins for entry-level mobile phones are shrinking due to a sharp rise in the cost of hardware components—specifically DRAM memory chips and NAND storage. To keep prices low, manufacturers are considering the use of recycled or refurbished RAM chips in future budget-friendly models.

As memory costs surge due to massive global demand from AI data centers, smartphone makers are turning to reballed and recycled RAM to keep entry-level devices affordable.

Why recycled RAM is emerging:

• AI demand squeezes supply: Massive investments in artificial intelligence data centers have driven up DRAM and NAND memory prices significantly, leading suppliers like Micron and Samsung to reallocate output.

• Soaring production costs: Memory can account for up to 60% of the total bill of materials for low-cost and mid-range smartphones, forcing brands to seek alternative cost-cutting methods.

• Market share of reballed chips: According to market research firm TrendForce via SammyFans, reprocessed or reballed memory is expected to account for 3% to 4% of the smartphone market in 2026, and that share could double to 7% to 9% by 2027.

• Focus on budget 4G models: Most reprocessed chips (such as 4GB LPDDR4X) are primarily targeted at affordable 4G handsets priced under local thresholds like 1,299 yuan.

Risks and trade-offs:

• Reduced reliability: Reclaimed chips are often harvested from decommissioned or 5-to-6-year-old devices, meaning prolonged wear can increase the likelihood of system errors or sudden crashes.

• Higher support costs: Inconsistent quality from refurbished parts can drive up repair rates and warranty claims for manufacturers.

• Potential expansion: If the chip crunch persists, analysts warn that lower-specification or recycled components may gradually stretch into more expensive, higher-tier phone segments

📉 Why is this happening? The smartphone industry is facing a "perfect storm" of rising costs:

• More expensive chips: The cost of critical components, such as RAM and storage, has increased significantly over the last few quarters.

• Budget pressure: Entry-level phones have very slim profit margins. Passing the full cost increase on to the consumer would push these devices out of the "affordable" category.

• The circular alternative: Utilizing RAM chips recovered from older devices—subjected to rigorous quality testing and refurbishment—emerges as a viable, sustainable way to cut manufacturing costs.

🛠️ What does this mean for the consumer? If this trend takes hold, the entry-level smartphone market is likely to adapt in the following ways:

• Controlled pricing: Recycling chips will help prevent the most affordable phones from becoming out of reach.

• Performance guarantees: Recycled components must undergo strict industry screening to ensure they deliver the speed and durability expected of a new device.

• Eco-friendly appeal: Brands are likely to promote this shift as a "green" circular economy initiative, helping to reduce electronic waste.

by mundophone

 

TECH

Energy security concerns spur faster renewables growth across a widening constellation of countries

New IEA forecast sees renewable capacity increase in emerging and developing economies outside China matching that in advanced economies for the first time as Hormuz crisis sharpens focus on domestic energy sources

Renewable energy is set to see strong growth across a wider range of countries worldwide in the coming years as governments seek to strengthen energy security and reduce exposure to fuel imports, according to the International Energy Agency.

In its Renewables 2026 report, the IEA said that renewable power capacity will increase by almost 4,800GW between 2026 and 2031, 60% higher than in the previous six-year period. Solar PV will account for more than 75% of this growth, followed by onshore wind.

In its forecasts, the IEA said that renewable capacity growth in emerging and developing economies outside China will match that in advanced economies for the first time.

The trend is being driven by “unprecedented disruptions to global energy markets since the outbreak of the Iran war at the end of February” that have intensified energy security concerns and led to stronger policy support in areas such as Southeast Asia, Africa, the Middle East and India.

China will remain the largest contributor to the global increase in renewable power capacity, but its share is set to decline from over 60% in 2025 to an average of 53% over the forecast period amid changes to its renewable energy policies, the IEA said.

India is emerging as the world’s second-largest growth market, with its total renewable capacity set to more than double by 2031. Growth is also accelerating across Southeast Asia, the Middle East and North Africa, and sub-Saharan Africa. Across these regions, the amount of renewable capacity added in the 2026-2031 period is forecast to almost triple compared with the previous six-year period.

“Previously, environmental concerns were the policy priority behind the growth of renewables, whose falling costs have made them a competitive option in many markets – but today, it’s mainly energy security that is driving renewables’ expansion as more and more countries seek to reduce their exposure to imported fuels,” said IEA Executive Director Fatih Birol.

“The new chapter of the renewables growth story is a truly global one as their deployment spreads well beyond major markets into every corner of the world. This is making them a key pillar of the global power sector. Today, they account for a third of global electricity generation; in the next five years, they will be getting closer to half of it.”

The report also highlights the importance of secure and diversified supply chains as renewables take on a larger role in energy systems worldwide. India is emerging as an important alternative source of supply, with its share of global solar PV module manufacturing expected to almost double to 17% over the next five years, helping diversify a market that remains highly concentrated.

Renewables, already expanding at a record pace before the current energy crisis, are set to see strong growth across a wider range of countries around the world in the coming years as governments seek to strengthen energy security and reduce their exposure to imported fuels and volatile prices, according to the IEA’s latest report.

Renewables 2026, this year’s edition of the IEA’s annual report on the sector, sees global renewable power capacity increasing by almost 4 800 gigawatts (GW) in the 2026-2031 period, almost 60% more than was added in the previous six-year period. Solar PV is set to account for more than three-quarters of global renewable capacity growth to 2031, followed by onshore wind.

Amid unprecedented disruptions to global energy markets since the outbreak of the Iran war at the end of February, stronger policy support and intensified energy security concerns are driving faster deployment of renewable power across India, Southeast Asia, Africa and the Middle East. For the first time, the amount of renewable power capacity added in emerging and developing economies outside China is expected to match the amount added in advanced economies in the forecast period.

China will remain the largest contributor to the global increase in renewable power capacity, but its share is set to decline from over 60% in 2025 to an average of 53% over the forecast period amid changes to its renewable energy policies. India is emerging as the world’s second-largest growth market, with its total renewable capacity set to more than double by 2031. Growth is also increasing across Southeast Asia, the Middle East and North Africa, and sub-Saharan Africa. Across these regions, the amount of renewable capacity added in the 2026-2031 period is forecast to almost triple compared with the previous six-year period.

“Previously, environmental concerns were the policy priority behind the growth of renewables, whose falling costs have made them a competitive option in many markets – but today, it’s mainly energy security that is driving renewables’ expansion as more and more countries seek to reduce their exposure to imported fuels,” said IEA Executive Director Fatih Birol. “The new chapter of the renewables growth story is a truly global one as their deployment spreads well beyond major markets into every corner of the world. This is making them a key pillar of the global power sector. Today, they account for a third of global electricity generation; in the next five years, they will be getting closer to half of it.”

The growth in renewable power additions is not only the result of major installations by utilities and developers; it is also being driven directly by consumers in many countries. Faced with high fuel prices and unreliable electricity supplies in some markets, households and small businesses around the world are increasingly turning to more affordable rooftop solar PV systems that can be installed quickly. These small-scale installations have already helped improve electricity services for around 70 million households worldwide, the report finds.

The report forecasts that the use of renewable energy for transport will rise by more than 60% by 2031, by which point it will cover 6% of the transport sector’s energy demand worldwide. Renewable electricity used by electric vehicles accounts for around 45% of this increase, while biofuels are making the second-largest contribution. As an immediate response to high fuel prices and availability challenges, several countries, notably in Southeast Asia and Latin America, have raised blending mandates, which set the minimum proportion of biofuels that has to be blended into gasoline or diesel sold at the pump. Our forecast for biofuels is revised up by 40% compared with last year’s report.

The report also highlights the importance of secure and diversified supply chains as renewables take on a larger role in energy systems worldwide. India is emerging as an important alternative source of supply, with its share of global solar PV module manufacturing expected to almost double to 17% over the next five years, helping diversify a market that remains highly concentrated.

As solar PV and wind continue to expand rapidly around the world, enhancing power system flexibility becomes critically important for energy security, offering new opportunities in the process. The highest priority is for countries to ensure investment in electricity grids keeps pace with the growth of renewable capacity. This should be complemented by reforms to speed up the connection of new renewable power installations to electricity networks. The amount of advanced-stage renewable energy and storage projects waiting for grid connections worldwide increased by 60% over the past year to 3 000 GW, four times the wind and solar PV capacity connected to the grid last year.

Meanwhile, the deployment of battery storage has been accelerating in many countries, offering an important way to increase the flexibility of electricity systems rapidly. Measures to enable electricity demand to become more flexible are equally important and can be implemented quickly. Digital technologies, including artificial intelligence, can help shift demand towards periods when renewable power supply is abundant, allowing a better use of variable renewable generation sources. Together, these measures will be crucial to ensuring that the rapid expansion of renewables translates into more secure, affordable and reliable energy supplies worldwide.

The quote you provided is the headline of the International Energy Agency (IEA) Renewables 2026 report, released on November 6, 2026.

The report highlights a profound paradigm shift: national energy security and a desire to reduce exposure to volatile imported fossil fuel prices have overtaken environmental concerns as the primary driver for green energy deployment. Driven by severe global energy disruptions (such as conflicts in the Middle East impacting the Strait of Hormuz), governments are rapidly prioritizing domestic green power to safeguard their economies.

📈 Core projections (2026–2031):

• Massive Capacity Growth: Global renewable power capacity is projected to increase by nearly 4,800 gigawatts (GW) over the next five years—an approximate 60% increase compared to the previous six-year period.

• Dominance of Solar: Solar PV is expected to account for more than three-quarters (75%) of all global renewable capacity additions.

• Share of Generation: Renewables currently account for roughly one-third of global electricity generation; they are on track to approach half (50%) of it by 2031.

🗺️ A "Widening Constellation": regional shifts...The IEA notes that the renewable expansion is truly global, with emerging and developing economies matching advanced economies' growth velocity for the first time.

• India: Positioned as a major alternative engine, India's renewable expansion is forecast to grow 2.6 times faster than in the previous six years. Furthermore, India is diversifying the supply chain, with its share of global solar PV module manufacturing expected to nearly double to 17%.

• China: Remains the largest market overall (accounting for 53% of global capacity growth), though it faces localized market headwinds and developer bankruptcies due to transitioning from fixed tariffs to competitive auction schemes.

• The Middle East & Africa: Regions like Southeast Asia, sub-Saharan Africa, and the Middle East are expected to triple their capacity additions. Saudi Arabia is accelerating its deployment fivefold, signaling a structural step-change in petrostates.

⚠️ Critical challenges to resolve...While capacity is surging, IEA Executive Director Fatih Birol warned of two major structural bottlenecks:

1. Grid Infrastructure and Backlogs: Advanced-stage renewable and storage projects waiting for grid connections skyrocketed by 60% over the past year to 3,000 GW—four times the capacity actually connected last year. Investment in electricity grids must drastically accelerate to prevent curtailment.

2. Supply Chain Risks: "The golden rule for energy security is diversification," says Birol. Avoiding a single trade route, single country (referencing China's historical dominance), or single company is vital for long-term system stability

mundophone

 

DIGITAL LIFE

Hackers exploited flaws in Chrome and Snapdragon to attack Android smartphones

An investigation by the cybersecurity firm Sekoia has uncovered a cyber-espionage campaign that leveraged vulnerabilities in Google Chrome and Qualcomm’s graphics drivers to compromise Android smartphones. The attack could be executed via an infected webpage, without the need for the user to install any applications or grant additional permissions.

Investigators have linked the operation to the group APT29, which is frequently associated with Russian foreign intelligence services. The primary targets appear to be individuals connected to diplomacy and the conflict in Ukraine, even though the campaign utilized publicly accessible websites.

According to Sekoia’s report, the attack on Android worked in stages. First, it used a Chrome flaw tracked as CVE-2026-3910 to run code inside the browser. It then exploited CVE-2025-27038, a bug in Qualcomm’s Adreno GPU driver, to break out of Chrome’s sandbox and gain deeper access to the phone. Since Adreno graphics are found in Snapdragon chips, phones powered by Qualcomm’s silicon were the ones affected.

The attack only targeted Chrome versions 139 through 145, though it skipped version 143 for reasons Sekoia says are unclear. Once a phone was compromised, the attackers dropped malware that Sekoia calls AndroSnitch. It copied Chrome’s cookies, saved login data, and browsing history, along with the phone’s saved Wi-Fi configuration file, which contains the passwords for networks you’ve connected to. Stolen cookies are especially valuable since they can let attackers slip into accounts that are already signed in.

Interestingly, the Android exploit was coded to stop if it detected a Samsung Galaxy S25 Ultra. Sekoia didn’t name any other phone models or Android versions that were specifically targeted.

The hack reportedly reached victims in several ways. The attackers injected malicious code into legitimate websites, set up lookalike copies of real sites, and compromised a Ukrainian web analytics service used by thousands of mostly Ukrainian websites between August 27 and September 3. The fake sites included a copy of the America250 website and one mimicking a luxury London hotel close to UK government offices. A script on these pages profiled each visitor’s device and then served the matching exploit.

Sekoia says the hacking campaign is linked to APT29, a hacking group tied to Russia’s foreign intelligence service. The targets suggest the group was mostly after diplomats and people connected to the war in Ukraine rather than ordinary Android and iOS users. Yes, iPhones were targeted too, with one exploit chain stealing cookies on iOS 16 through 17.4 and the DarkSword exploit grabbing messages, photos, and passwords from devices on iOS 18.5.

The attack combined two distinct vulnerabilities. The first, identified as CVE-2026-3910, affected certain versions of Google Chrome and allowed for the execution of malicious code within the browser.

The second, CVE-2025-27038, was found in the Adreno graphics drivers used in Qualcomm’s Snapdragon processors.

The combination of these flaws made it possible to bypass security protections that typically prevent the browser from accessing sensitive areas of the operating system.

Once a device was compromised, the attackers would install a piece of malicious software identified as "AndroSnitch."

This malware collected data such as saved passwords, browsing history, authentication cookies, and Wi-Fi network settings—including the associated credentials.

The cookies were a particularly valuable target, as they can grant access to already-authenticated accounts without requiring the user to re-enter their password.

The exploit chain targeted Chrome versions 139 through 145, with the exception of version 143.

Legitimate websites were used to distribute the malware; the campaign did not rely solely on fraudulent pages created by the attackers. According to Sekoia, those responsible also compromised legitimate websites and injected malicious code into a Ukrainian traffic analysis service used by thousands of web pages.

This component of the operation was active between August 27 and September 3, 2026.

When a visitor accessed one of the affected pages, a script would analyze the device's features to determine which exploitation technique was most appropriate.

The researchers also identified a curious behavior: the code would automatically abort the attack if it detected a Samsung Galaxy S25 Ultra. The reason for this exclusion remains unknown.

The operation also sought to compromise Apple devices, leveraging other vulnerabilities specific to iOS.

Despite the severity of the campaign, the two flaws used against Android smartphones have already been patched.

Devices running updated versions of Chrome with the relevant security patches installed are protected against this known exploit chain.

It is important to note that the research describes a targeted campaign, not an indiscriminate attack on all Android users.

Nevertheless, this case demonstrates how vulnerabilities in different components can be combined to bypass security mechanisms otherwise considered robust.

Exploiting a flaw in the browser, followed by another in the graphics driver, also illustrates the importance of keeping both applications and the operating system itself up to date.

To reduce exposure to similar attacks, it is recommended to regularly install updates provided by manufacturers, use recent versions of web browsers, and avoid using devices that no longer receive security patches.

Hackers linked to the Russian intelligence group APT29 exploited a combination of browser and hardware flaws to target Android smartphones.

Attack Details:

• Vulnerabilities exploited: The attack combined the CVE-2026-3910 flaw in Google Chrome (within the V8 engine) to execute code in the browser, and the CVE-2025-27038 flaw in the Qualcomm Adreno GPU driver to escape the system's security sandbox.

• Affected devices: Android devices equipped with Qualcomm Snapdragon processors running versions of Chrome between 139 and 145 (excluding version 143). Interestingly, the exploit was programmed to abort if it detected a Samsung Galaxy S25 Ultra.

• Malware deployed: The malicious program, dubbed "AndroSnitch" by the security firm Sekoia, stole session cookies, browsing history, saved passwords, and Wi-Fi network configuration files.

• Infection method: The attack took place via compromised legitimate websites or fake pages that injected JavaScript to profile the device and automatically deliver the exploit. Further details on the operation can be found on Android Authority and Gadgets360.

How to protect your phone:

• Update Google Chrome: Go to the Google Play Store and install the latest version of the browser.

• Install system updates: Check for any pending monthly security patches in your Android device's settings.

mundophone

 

SAMSUNG

Galaxy S27 Ultra may feature an exclusive Qualcomm processor

Samsung appears to be preparing a significant shift in the processor strategy for its next generation of smartphones. New commercial filings associated with the Galaxy S27 series suggest that the South Korean manufacturer may reserve the most powerful version of Qualcomm’s upcoming processor exclusively for the Galaxy S27 Ultra, while other models will feature different configurations.

This information was reported by Gadgets360, based on a discovery by Notebookcheck on the trade data platform NBD. The filings identify four devices—including the as-yet-unannounced Galaxy S27 Pro—and reveal a potential split between Exynos and Snapdragon processors for the European market.

If these details are confirmed, Samsung could establish a clearer performance hierarchy among its high-end smartphones, at a time when competition in the premium segment remains particularly intense.

The key development concerns the processor identified for the Galaxy S27 Ultra. The device is linked to the model number SM-S958B/DS and the Qualcomm chip SM8975, which is expected to correspond to the upcoming Snapdragon 8 Elite Extreme Gen 6.

Meanwhile, the purported Galaxy S27 Pro—identified as SM-S957B/DS—is equipped with the Qualcomm SM8950, associated with the standard version of the Snapdragon 8 Elite Gen 6.

This distinction suggests that Samsung might reserve the most advanced variant of the processor for the Ultra, creating an additional point of differentiation between the two premium models in the lineup.

Naturally, the presence of different processors does not yet reveal what the actual differences in performance, power consumption, or artificial intelligence processing capabilities will be. These characteristics will depend on the final specifications of the chips and how they are integrated into the devices.

However, the newly surfaced documents introduce an important detail: the possibility that the Galaxy S27 Pro could utilize a Snapdragon processor, even in its European variants. Until now, rumors regarding processor distribution suggested that Samsung might keep Exynos chips in Europe while reserving specific Snapdragon variants for other markets.

The emergence of references specifically linked to European devices reinforces the hypothesis of a more nuanced strategy, although these commercial filings do not constitute definitive confirmation of the configurations that will ultimately reach retail shelves.

Four models with varying screen sizes...In addition to the processors, the documentation provides details on the screen sizes for each device.

Model | Screen Size | Indicated Processor

Galaxy S27 | 6.3 inches | Exynos 2700

Galaxy S27+ | 6.7 inches | Exynos 2700

Galaxy S27 Pro | 6.5 inches | Snapdragon 8 Elite Gen 6

Galaxy S27 Ultra | 6.9 inches | Snapdragon 8 Elite Extreme Gen 6

All four models are also associated with configurations featuring 12 GB of RAM and 256 GB of internal storage.

These figures do not necessarily mean that every commercial variant will feature the same configuration; the records may simply represent specific versions used for import, testing, or certification processes.

Another detail yet to be confirmed concerns the cameras. Rumors point to 200-megapixel main sensors for both the Galaxy S27 Pro and the Ultra, which could bring the photographic capabilities of the two devices closer together.

Even so, sensor resolution alone does not determine the final quality of photographs, nor does it imply that both devices will feature equivalent camera systems.

The potential introduction of a Galaxy S27 Pro could represent a significant shift in the structure of the Galaxy S lineup.

To date, Samsung has primarily relied on the distinction between the base, Plus, and Ultra models to differentiate features, dimensions, and photographic capabilities.

By offering four devices, the manufacturer could provide a more compact premium alternative, positioned between the Galaxy S27+ and the Ultra. The processor could become one of the key differentiators, alongside cameras, build materials, and exclusive features.

Interestingly, rumors also point to differences in charging capabilities. As we previously reported, the base Galaxy S27 may remain limited to 25W, while the Pro and Ultra models have been linked to charging speeds of up to 60W.

If this scenario holds true, Samsung will be opting for a more distinct separation between the various tiers of its premium lineup.

The official unveiling of the Galaxy S27 family is expected to take place in early 2027, during a Galaxy Unpacked event.

Until then, several questions remain unanswered, including whether a "Pro" model will definitely exist, the differences between the new processors, and the specific configuration intended for the Portuguese market.

It is also worth noting that previous reports had suggested a potential return of the Exynos chip to the Galaxy S27 Ultra. The latest findings point to a different scenario, though they do not entirely rule out the possibility of additional variants.

For now, all signs suggest that Samsung is exploring a more diverse product lineup. It remains to be seen whether this strategy will offer tangible benefits to consumers or if it will primarily serve to further distinguish the various price tiers.

What sets the Snapdragon 8 Elite Gen 6 apart from the "Extreme" version? The Extreme Gen 6 features eight cores built on a 2nm process: two "Prime" cores at 5.0 GHz, three at 4.0 GHz, and three at 3.7 GHz, along with an Adreno 850 GPU clocked at 1.45 GHz. Qualcomm has also included matrix calculation units for AI-driven upscaling and frame generation—features absent from the standard Gen 6 chip, which is expected to power the Pro model.

A similar segmentation already exists among competitors; for instance, Xiaomi opted for the standard Gen 6 in its 18 Pro, while reserving the Extreme version for the 18 Pro Max. If Samsung follows this same logic, the Pro model will feature the 2nm chip but will fall short of the Ultra in terms of GPU and AI capabilities.

Back in June, the expectation was that both the Pro and Ultra would share the same Snapdragon processor. Since then, according to the *Seoul Economic Daily*, Samsung reportedly raised concerns with Qualcomm regarding overheating issues with the Extreme Gen 6—claims that Qualcomm has denied.

If the filing is accurate, the Ultra has retained the high-end chip, while the Pro has been positioned a step lower. The Galaxy S27 Pro sits between the S27+ and the Ultra—and this hierarchy extends to the processor as well. With a 6.5-inch display, a 5,200 mAh battery, and rumored 200 MP camera, the S27 Pro occupies the tier previously held by the "Plus" model, with the chip selection following that same structure.

It ranks above the S27+ (which uses an Exynos chip) and below the Ultra (which uses the Extreme version). This allows Samsung to offer three distinct price points, each corresponding to a different level of performance.

For now, none of this is official, as Samsung typically unveils its S-series lineup in late January or early February. In reality, Brazil is likely to receive the same "B" variant mentioned in the filing. The S27 and S27+ sold here are expected to come with the Exynos 2700, while the Pro will feature the Gen 6.

If this difference in chips is reflected in the price, the Pro becomes the more rational choice for those who don’t need the S Pen or the Ultra’s zoom capabilities. Does paying more for the "Extreme" model—just to get AI-powered frame generation—seem worth it to you?

by mundophone

DIGITAL LIFE

How to identify potential spyware and prevent unauthorized access to your mobile phone

You are using your phone as usual when you notice something strange: the battery starts draining faster, the device heats up for no apparent reason, or a small colored dot appears on the screen. Most of the time, these behaviors have simple explanations. However, they could also indicate that an app is accessing features without your authorization. Knowing how to distinguish a common glitch from a potential intrusion is essential for protecting your personal information.

The small signal on the screen that can reveal camera usage...One of the simplest ways to find out when the camera or microphone is being used is to observe your device's privacy indicators.

On modern iPhones, a green dot appears when an app accesses the camera, while an orange dot indicates that the microphone is in use.

Recent Android phones also feature similar visual indicators, typically displayed at the top of the screen.

These features allow you to identify access even when the app is not actively open on your screen.

If an indicator appears unexpectedly, it is worth checking which program is using that feature.

Another behavior that warrants attention is receiving a message stating that the camera is already in use by another application.

However, this does not necessarily mean that your phone is being spied on.

Calling apps, social media platforms, and other legitimate services may use the camera or microphone in the background, depending on the permissions granted and the activities currently running.

Malicious programs known as spyware can monitor your activities, collect information, and, under certain circumstances, access sensitive features of your device.

According to guidance from the cybersecurity firm ESET, unexpected changes in how your phone functions deserve attention.

One example is excessive battery consumption.

If an app is continuously recording information or transmitting files, it may demand more power from the device.

The same applies to abnormal heating, especially when the phone is idle and seemingly not performing any tasks. Another possible sign is the presence of photos, videos, or screenshots that you do not recognize.

However, before assuming your device has been compromised, check whether these files were received via WhatsApp, downloaded automatically, or synced through services like Google Photos or iCloud.

None of these symptoms, on its own, proves the presence of spyware.

Worn-out batteries, software updates, or resource-intensive apps can also cause similar behavior.

Data usage can reveal what is happening in the background; beyond battery drain, mobile data traffic can provide important clues.

A malicious app that sends images, recordings, or other files to external servers may cause an unexplained spike in data usage.

For this reason, it is worth checking which programs are consuming the most data on your device.

Unknown apps or those showing high activity warrant closer investigation.

You should also watch for unexpected reboots, persistent sluggishness, frequent crashes, or the appearance of programs you do not recall installing.

While these signs can have various causes, a combination of unusual behaviors justifies a review of your security settings.

The goal is not to immediately conclude that your device has been compromised, but rather to identify activity that does not align with your typical usage.

How to find out which apps have access to your camera and microphone: modern operating systems provide tools to check and manage permissions.

On an iPhone, go to Settings, select Privacy & Security, and then choose Camera or Microphone. From there, you can review which apps have been granted access and revoke permissions that are unnecessary.

On Android, the steps may vary depending on the manufacturer and the version of the operating system. Generally, look for Settings, Security & Privacy, and then Privacy Dashboard or Permission Manager.

These sections allow you to see which apps have access to sensitive features and, on compatible versions, to review recent access history.

It is also advisable to keep your system updated, remove suspicious apps, and avoid installing software from unknown sources.

If the signs persist, a reliable security tool can assist with an investigation.

What should you do if you suspect your phone is being spied on? The first step is to review your installed apps and revoke any unnecessary permissions.

Next, check for security updates and analyze your battery and data usage.

If you find concrete evidence of a compromise, consider changing your passwords—using a different, trusted device—and seeking professional technical support.

The best form of protection is to maintain control over which apps have access to your camera, microphone, and personal information.

A phone that runs hot or a battery that drains quickly does not automatically mean you are being spied on.

However, keeping an eye out for unexpected changes and being familiar with privacy features can help you identify issues before they become more serious.

To identify spyware and protect your mobile phone from unauthorized access, look for warning signs on your device and follow the steps for removal and prevention.

Warning signs (how to identify them):

• Excessive battery drain: Your phone loses charge very quickly, even when not in use or during normal activity, because spyware is transmitting data in the background.

• Abnormal heating: The device frequently gets hot, even when you are not playing games or running resource-intensive applications.

• High mobile data usage: Unexpected spikes in internet traffic occur because files, photos, or audio are being transmitted to external servers.

• Unknown applications: Apps you did not download appear in your list of installed applications, or they may be disguised with generic names (such as "system update" or "service").

• Camera or microphone indicators: Green or orange dots appear on the screen, signaling that these sensors are active without your permission.

• Call and message forwarding: Settings for call forwarding or unknown paired devices appear in your linked accounts.

How to investigate and remove spyware:

1. Inspect installed applications: Go to Settings > Apps (on Android or iPhone) and remove any programs you do not recognize.

2. Check permissions and device administrators:

• On Android, go to Settings > Security & privacy > Permission manager or Device admin apps (disable administrator privileges for suspicious apps before uninstalling them). 

• On iPhone, go to Settings > General > VPN & Device Management to check for suspicious MDM (Mobile Device Management) profiles.

3. Review connected accounts and devices: Open your Google account or Apple ID settings and sign out of any unknown sessions, browsers, or devices. 4. Run a security scan: Use reliable antivirus and antimalware applications, such as Kaspersky, Bitdefender, or Norton.

5. Perform a factory reset (if necessary): If the spyware persists or if you suspect a deep-level compromise, back up your essential files and restore the device to its factory settings. Change all your email and banking passwords using a different, secure device.

mundophone

 

TECH

Enough Phone is as small as iPhone 13 mini, launches with modular battery and 5 years of updates

With the Apple iPhone 13 mini and the Asus Zenfone 10, the last truly compact mainstream smartphones were discontinued years ago. Fans of small smartphones now finally have a new option in the Enough Phone, which also aims to impress with a replaceable battery and long-term software support.

After we reported on the development of the Enough Phone back in August, the compact smartphone is now finally available to preorder through a crowdfunding campaign. Measuring 133 x 64 millimeters, the device is 16.6 millimeters shorter and 7.5 millimeters narrower than the Apple iPhone 17 ($719 on Amazon), and is actually almost the same size as the Apple iPhone 13 mini.

However, the Enough Phone is relatively thick at 12 millimeters. This is due in no small part to the back being screwed on rather than glued, making the 3,500 mAh battery particularly easy to replace. The phone ships with a choice of Android 17 with full app support or OdysseyOS, a simplified operating system that forgoes features such as social media apps. In either case, the Enough Phone is set to receive security updates until 2032.

Unscrew the backplate on the enough phone to reveal its battery. When it wears out, swap it yourself, just like the good old days. 

Software updates are planned through 2032, and the back is made from recycled polycarbonate. 

One enough phone should last you into the next decade.

While this should give the device a relatively long life span, its plastic housing is not waterproof. Its specifications are in line with a conventional mid-range smartphone, as the Enough Phone features a MediaTek Dimensity 7500, paired with 8 GB of RAM, 128 GB of storage and a microSD slot. The 50 MP main camera uses a Sony IMX766 sensor in the 1/1.56-inch format, while the selfie camera offers a resolution of 32 MP. The 5.3-inch display has a resolution of just 1,520 x 720 pixels. A fingerprint sensor in the lock button, an NFC chip and a GPS module round out the specifications.

At first glance, it looks like a phone you might have bought about 15 years ago. But this is actually a forward-looking project: the Enough Phone is a compact smartphone designed to bring back the simplicity that Android once offered. It could be yours for $399.

The "straight-to-the-point" philosophy of the Enough Phone begins with its display—a 5.3-inch LCD panel with a resolution of 1520 x 720 pixels. Its small size by today’s standards highlights just how compact the device is: measuring 132.8 x 63.8 x 12 mm, it’s roughly the same size as an iPhone 13 Mini.

There’s a good reason for this. According to the project’s creators—Austin Boer, Brennan Jordan, and William Stults—mainstream brands have largely abandoned compact phones. While it’s true that most people prefer smartphones with large screens, the trio believes there are still users who miss having smaller options (I’ll admit, I’m one of them).

As for the device itself, the back features a single camera with a 50-megapixel Sony IMX766 sensor. Look closely, and you’ll notice screws just below the camera module; this is because the Enough Phone includes a user-replaceable battery.

Under the hood, the phone is powered by a MediaTek Dimensity 7500 chip, paired with 8 GB of RAM and 128 GB of storage. It runs a "pure" version of Android 17.

Alternatively, users can opt for OdysseyOS—a highly simplified version of Android developed by Sleke—which offers an experience similar to that of a basic, no-frills mobile phone. Sleke sells refurbished Google Pixel phones running OdysseyOS, catering to those who prefer or prioritize simpler, more intuitive features.

Other specifications include:

a 32-megapixel front-facing camera

5G, Wi-Fi 6, Bluetooth, and NFC connectivity

eSIM support

a power button with an integrated fingerprint reader

a 3,500 mAh battery (a specification subject to change before launch)

The "Enough Phone" is a crowdfunding project currently running a campaign on Kickstarter. Early backers can purchase the device starting at $399, as previously mentioned.

In my view, this price point is somewhat high given the device's hardware—and it could get worse: upon its official release—expected sometime after May 2027 (the month currently slated for deliveries)—the device may carry an official price tag of $599.

Regardless, it could prove to be an interesting option for those seeking a compact yet functional Android smartphone.

Pricing and availability...The Enough Phone is currently being funded on Kickstarter and costs $399 under the "Super Early Bird" offer, with shipping expected to begin in May 2027. The price excludes shipping, import VAT and customs duties. Backing crowdfunding campaigns carries the risk of products being delivered late, not at all or with quality issues, especially as the manufacturer has yet to show a working prototype.

 

mundophone