Stego-Lab

Stego-Lab Esteganografía. EXIF. Marcas de agua. Decodificar. Lote. Flujos de trabajo profesionales de privacidad de imágenes para iPhone, iPad y macOS. Sitio web · GitLab · Página del proyecto · Política de privacidad · Kit de prensa · Soporte · Licencia Por qué Stego-Lab Stego-Lab reúne flujos d...

Awesome-MoAI-Security

Awesome Mobile On-Device AI Security SoK: Attack and Defense Landscape of Mobile On-device AI Systems Mobile on-device AI systems execute AI models locally through ML frameworks such as LiteRT/TFLite , Core ML , ExecuTorch , ONNX , and hardware-backed accelerators. This repo tracks the security...

abdal-lockbox

🔐 Abdal LockBox 🌐 Read in your language: 🇬🇧 English | 🇨🇳 中文 | 🇷🇺 Русский | 🇪🇸 Español | 🇯🇵 日本語 | 🇮🇷 فارسی | 🇸🇦 العربية | 🇹🇷 Türkçe | 🇩🇪 Deutsch | 🇮🇳 हिन्दी Secure. Store. Autofill. — A privacy-first Android password manager by Abdal Security Group. Abdal LockBox keeps your credentials encrypted on...

HydraDragonAV-Mobile

🐉 HydraDragonAV Mobile थ्रेट प्रोटेक्शन के साथ उन्नत एंड्रॉइड एंटीवायरस ⚠️ प्रोजेक्ट रोका गया है। इस प्रोजेक्ट को पर्याप्त रुचि नहीं मिली, इसलिए मैंने इसे कुछ समय के लिए रोक दिया है। विकास HydraDragonAntivirus पर स्थानांतरित हो गया है। डिस्कॉर्ड कम्युनिटी सर्वर: https://discord.gg/7XMCuj5mbP लोगो...

frida-c2-mcp

FridaC2MCP Un server MCP con trasporto HTTP streamable che esegue la strumentazione dinamica di Frida interamente sul dispositivo — nessun tool lato client richiesto. Questo progetto gira direttamente su dispositivi Android rooted e iOS jailbroken , esponendo Frida come un insieme di strumenti...

androidReverse

Android Reverse A reverse engineering suite that runs entirely on Android. No PC, no ADB, no desktop tools — everything from APK extraction to native binary analysis, editing, and rebuilding happens on-device. MCP Server androidReverse includes a built-in Model Context Protocol server, allowing...

on-device-browser-agent

लोकल ब्राउज़र - डिवाइस पर AI वेब ऑटोमेशन जल्द ही हमारे मुख्य रिपॉजिटरी में runanywhere-web-sdk के लिए समर्थन लॉन्च कर रहे हैं: कृपया इसे देखें: https://github.com/RunanywhereAI/runanywhere-sdks एक Chrome एक्सटेंशन जो WebLLM का उपयोग करके AI-संचालित वेब ऑटोमेशन को पूरी तरह से डिवाइस पर चलाता है। क...

Project-Pwnag0dchi

Progetto Pwnag0dchi Creato perché molte persone chiedevano informazioni sui plugin personalizzati e le configurazioni che uso. Seguendo questa guida, il tuo Pwnagotchi avrà un aspetto esattamente come quello che vedi sui miei social e video YouTube in circa 5 minuti massimi. Troverai anche una...

nfcgate

NFCGate ⚠️NFCGate is currently being falsely detected as "NGate" malware. Please seethis issue for up-to-date information.⚠️ NFCGate is an Android application meant to capture, analyze, or modify NFC traffic. It can be used as a researching tool to reverse engineer protocols or assess the security...

PT-2026-64895

A lack of authentication in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization...

CVE-2026-65058 Trezor Safe improper security check in on-device display

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum signtx / signtxeip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata...

CVE-2026-65058

The CVE-2026-65058 affects Trezor Safe firmware 3, 5, and 7, where a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow allows an attacker to present calldata and later supply a different tail, changing the signed transaction while only the initial calldata chunk is confirme...

CVE-2026-65058 Trezor Safe improper security check in on-device display

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum signtx / signtxeip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata...

Protecting On-Device AI Inference: A Systematic Review of Attacks and Defence Mechanisms

The need for secure and private Artificial Intelligence AI and Machine Learning ML on edge and mobile devices has increased the necessity of protecting the architecture of these systems from threats to both security and privacy. With an ever-increasing number of pre-trained AI models being used o...

CVE-2026-46061

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix deadlock in jbd2journalcancelrevoke Commit f76d4c28a46a "fs/jbd2: use sleeping version of findgetblock" changed jbd2journalcancelrevoke to use findgetblocknonatomic which holds the folio lock instead of iprivatelock. Th...

Speed Kills: Exploring Confused Deputy Attacks through Edge AI Accelerators

AI Accelerator AIA are specialized hardware e.g., Tensor Processing Unit TPU, that enable optimal and efficient execution of AI applications and on-device inference. The growing demand for AI applications has led to the widespread adoption of AIAs on Edge or embedded devices on Edge or embedded...

Google Chrome’s silent 4GB AI download problem [updated]

Google Chrome has been quietly downloading a 4GB AI model onto users' devices without asking first. Security researcher Alexander Hanff, aka ThatPrivacyGuy, reports that Chrome has been silently installing Gemini Nano, Google's on-device AI model, as a file called weights.bin stored in the...

WOOTdroid: Whole-System Online On-Device Tracing for Android

System auditing on Android faces two problems. First, existing syscall tracers lose events under load, silently overwriting entries faster than a user space reader can drain them. Second, security-relevant application behavior is mediated through Binder, Android's kernel IPC mechanism, and is...

Agentic Knowledge Distillation: Autonomous Training of Small Language Models for SMS Threat Detection

SMS-based phishing smishing attacks have surged, yet training effective on-device detectors requires labelled threat data that quickly becomes outdated. To deal with this issue, we present Agentic Knowledge Distillation, which consists of a powerful LLM acts as an autonomous teacher that fine-tun...

CVE-2026-1411 Beetel 777VR1 UART access control

A flaw has been found in Beetel 777VR1 up to 01.00.09/01.00.0955. The affected element is an unknown function of the component UART Interface. This manipulation causes improper access controls. It is feasible to perform the attack on the physical device. The complexity of an attack is rather high...