The core exploit leverages Gemini’s Android Utilities agent, specifically the tool that reads incoming notifications. Because this tool processes untrusted data from third-party apps, an attacker can embed malicious instructions directly inside a crafted message. S4GET is a serious, remotely exploitable, unauthenticated threat to any system running one of the is Amoredate free to use vulnerable kernels.
Hacking & Defending Sap Applications – Live
Now in 2025, zero-days remain the leading method of initial compromise, accounting for roughly one-third of all intrusion attempts. The imagent process has been a frequent target for sophisticated attackers, having been exploited in previous high-profile campaigns including FORCEDENTRY and BLASTPASS operations. In this post, we’ll explore the major data breaches that affected messaging apps between 2020 and 2024, analyze what went wrong, and extract lessons to build safer communication platforms — without sacrificing convenience. AI agents are already operating inside enterprises with growing access to sensitive systems and data—while security teams still lack the visibility, controls, and governance to keep that access in check. On an individual level, there are several guidelines anyone can follow to reduce their exposure when using messaging apps.
The postMessage API was specifically designed as a controlled exception to this policy, allowing developers to explicitly enable safe, cross-origin communication when needed, provided it is used properly. After Google patched earlier vulnerabilities by blocking chained tool invocations and Delayed Tool Invocation, SafeBreach researchers developed a novel bypass technique dubbed Fake Context Alignment. However, those that do not meet the criteria above will be categorized as “Lowest Priority – not scheduled for immediate enrichment.” This will allow us to focus on CVEs with the greatest potential for widespread impact. While CVEs that do not meet these criteria may have a significant impact on affected systems, they generally do not present the same level of systemic risk as those in the prioritized categories. The changes described below will allow us to focus on the most critical CVEs while being transparent about how we are managing our current workload. They will also allow us to stabilize the program while we develop the automated systems and workflow enhancements required for long-term sustainability.
- CISA has classified both vulnerabilities as actively exploited threats, though the agency notes that their potential use in ransomware campaigns remains unknown at this time.
- Starting August 26th, 2026, the entries will not include the affected data but will contain a GitHub Link (a direct URL to the CVE record on GitHub).
- Even though all of the vulnerabilities have been patched by the app developers, hackers would still be able to exploit the loophole if the targeted devices are running an older version of the apps.
- The application uses cloud-based permission arrays to control JSBridge interface access, providing fine-grained control over webpage capabilities.
- In organizations like the Balearic Islands Health Service , instant messaging has become an essential tool for rapid communication between professionals, but that doesn’t mean you can use just any app you have on your personal phone.
SafeBreach disclosed the findings to Google’s Vulnerability Reward Program on August 17, 2025. Google confirmed on November 14, 2025, that updated content classifier improvements successfully mitigated the indirect prompt injection and Delayed Tool Invocation scenarios described in the research. Lastly, scheduled surveillance tactics allow the establishment of recurring tasks that automatically read the user’s recent messages daily, further compromising their privacy and security.
Data Breaches From Messaging Apps: 2020–2024 — Lessons For A Safer Digital Future
The first is to treat phone numbers and codes received via SMS as sensitive credentials that should never be shared , even if the person requesting them appears to be a friend, a technician, or the app itself. CISA has issued an urgent warning regarding two critical vulnerabilities in TeleMessage TM SGNL that threat actors are currently exploiting in active attack campaigns. The issue “stems from the platform’s continued use of a legacy confirmation in Spring Boot Actuator, where a diagnostic /heapdump endpoint is publicly accessible without authentication,” the research team told Cointelegraph.
Pablo ‘Partu’ Agustin Artuso is a skilled security researcher with expertise in identifying vulnerabilities and improving the security of business-critical applications. With a strong background in cybersecurity and a focus on systems like SAP, he has contributed to enhancing organizational resilience. His technical proficiency and hands-on experience have positioned him as a key player in the field of enterprise security. During his time at Onapsis he has been selected to speak at Black Hat USA, Ekoparty, and was the lead researcher in the discovery of the family of vulnerabilities dubbed P4CHAINS. These platforms handle critical activities including social interactions, financial transactions, and business communications for billions of users globally, making successful attacks particularly devastating. Researchers demonstrate how attackers can craft malicious files disguised as legitimate content to achieve remote code execution.
