Hackers Can Steal 2FA Codes and Private Messages From Android Phones
Researchers demonstrated Pixnapping exploits a vulnerability in Android to capture data from other apps, including 2FA codes, affecting multiple Pixel and Samsung devices.
- On Oct 14, 2025, researchers at the University of California, the University of Washington, and Carnegie Mellon University reported Pixnapping, an attack letting malicious Android apps capture pixels from other apps and websites.
- Building on GPU.zip research, Alan Wang, PhD candidate at UC Berkeley, said, `Our group's prior work on GPU.zip...` and the flaw is tracked as CVE-2025-48561, reviving 12-year-old browser pixel attacks.
- Measured data show on Google Pixel 6, Pixel 7, Pixel 8, and Pixel 9, the attack recovered full 6-digit codes at 73%, 53%, 29%, and 53% respectively, from 100 leaked codes.
- Despite initial patches, Google said it will issue an additional December Android security bulletin patch, while researchers warn that `Fixing Pixnapping will likely require changes to core Android mechanisms`.
- Researchers warn the attack can expose two-factor authentication codes, private messages, and financial data, and because the core mechanism is present on all modern Android handsets, many devices may be vulnerable.
25 Articles
25 Articles
New 'Pixnapping' attack lets hackers steal Android chats, 2FA codes in seconds
Cybersecurity researchers have discovered a new type of attack that affects Android devices, and they say it lets hackers get their hands on your private data in a matter of seconds.This includes your private chats, text messages, emails, and even two-factor authentication (2FA) codes, as Ars Technica reported.The attack, dubbed "Pixnapping" by the team of researchers who discovered it, can be used to extract information from any data displayed …
Although the vulnerability has been discovered on Google Pixel and Samsung Galaxy S25 mobile phones, the team does not rule out that it has affected other manufacturers.
Coverage Details
Bias Distribution
- 75% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium