Tag
Google and industry partners dismantled the XCPE botnet, which turned 1.3 million Android TV boxes into residential proxy nodes and could sever access to 10 million more compromised IoT devices. The takedown targeted Chinese manufacturer Videostrong Technology, which shipped malware on its set-top boxes.
Google revealed that one of its Android manufacturing partners, Shenzhen-based Videostrong Technology, secretly built a backdoor into 1.3 million set-top boxes and other Android devices, turning them into a botnet used for ad fraud and malware distribution. Google has dismantled the backdoor, cut ties with the manufacturer, and updated its device review process.
Amos Batto's article responds to widespread community debate by arguing the distinct advantages of dedicated mobile Linux distributions over relying on AOSP as the path to a Linux-based phone ecosystem.
An introduction to the open-source tool NOIR: an Android privacy auditing tool that runs on your computer, scanning connected devices via adb for app permissions, APK network endpoints, and manifest information, then generating risk scores, data-flow correlations, and reversible remediation suggestions.
The NOIR tool on GitHub can scan domestic phones via adb over USB, generating a list of domains that exfiltrate data such as location and contacts, along with rollback commands, for checking a phone's privacy leaks.
Mika is an open-source Android AI assistant that operates your phone apps on a background virtual screen (sending messages, reading group chats, comparing prices, adding to cart, etc.). It supports bringing your own model API key and doesn't route through their servers. It has already gained 3,810 stars in about 3 days since launch.
A follow-up on running agents on an Android phone to publish TikTok posts via app UI automation, detailing bugs around confirming whether a post actually went live and the need for idempotency keys and treating timeouts as 'unknown'.
NIDO 0.1.67-alpha, a 100% offline personal AI assistant for Android, is released following a full app audit that identified 124 issues—88 of which are fixed and verified in this version, alongside 4,711 passing tests and a rebuilt Local knowledge pack.
A user ran the Big Fat Fish tool on their Xiaomi 17 Pro Max and cited warnings that domestic Android phones may report their app lists, advising against using Chinese phones for circumventing the firewall or installing foreign apps.
Mika surpassed 2,000 GitHub stars less than 48 hours after going open source. It is a local AI phone agent that runs on Android phones, can control any app and webpage to complete tasks automatically, and has added capabilities such as self-learning and MCP support.
The Molly fork of Signal has not been updated in three months and remains vulnerable to security flaws already patched in mainline Signal, prompting recommendations to switch back to the official Signal app.
A practitioner describes running multiple AI agents on a single rooted Android phone via MCP/REST tooling instead of official APIs, detailing what broke first: UI drift, shared-inbox ownership, duplicate replies from retries, platform rate limits, and screen contention between agents.
Mika has been officially open-sourced — it's a Phone Agent that runs directly on Android phones, capable of automatically executing tasks in the background via ADB + Accessibility permissions, without the need for Root or a computer. Its speed is claimed to far exceed that of Computer Use.
An unofficial open-source version of DeepSeek Harness for Android has been released, bringing an AI agent to your Android phone without root access. It can read your screen, operate any app, organize files, and automatically perform tasks.
DeepSeekHarness-Android updated to v0.1.7, with 7 releases in less than a day. Full integration with 12 third-party model providers including OpenAI, Claude, and Gemini. New sessions default to relaxed permissions to reduce approval prompts. Also fixed image upload EACCES errors and layout issues on narrow screens.
Claude's mobile apps received a batch of usability upgrades, including side-by-side content viewing on iPad/iPhone Duo, multi-account switching on iOS and Android, laptop-style windowing on Chromebooks and foldables, improved and more natural voice mode, and new Apple CarPlay support.
The unofficial open-source project DeepSeek Harness has released an Android version, bringing the full DSH (DeepSeek Harness) to Android phones as an APK, with no root access or Termux required. It supports screen reading and tapping, file management, system settings, automation triggers, and more.
A zero-click vulnerability called 'SMS of Death' lets a single malformed WAP Push SMS crash Android's com.android.phone process, dropping active calls (including emergency calls) and potentially bricking telephony via SQLite corruption; Google classified it as non-security and won't fix.
Google is opening enrollment for its Android Registered App Stores program, launching December 1 with strict security requirements and a $10,000 annual fee, though it will only be available outside the US and require Android 17 QPR2 or newer.
Capy now offers cloud-based mobile devices for building and testing iOS and Android apps on cloud phones, powered by Revyl.