Google has only partially mitigated the attack, which involves using a malicious Android app to secretly discern the two-factor codes generated by authenticator apps.
New Android exploit “Pixnapping” can secretly read on-screen data like 2FA codes and messages using pixel timing — even ...
Researchers demonstrated Pixapping attacks on high-end smartphones such as the Google Pixel 10 and the Samsung Galaxy S25 ...
Pixnapping side-channel can steal 2FA codes pixel-by-pixel on Android 13–16; CVE-2025-48561 patched Sept 2025 but workaround ...
Android devices are vulnerable to a new attack that can covertly steal 2FA codes, location timelines, and other private data ...