Android Pixnapping Attack Steals 2FA Codes in Seconds

A new side-channel attack named Pixnapping allows malicious Android apps to steal sensitive data directly from a device's screen. The attack requires no special permissions and exploits a GPU hardware vulnerability to covertly reconstruct visual information from other applications, pixel by pixel. Researchers demonstrated that it can extract two-factor authentication codes in under 30 seconds, as well as private messages and financial details from popular apps. This vulnerability affects a wide range of modern smartphones running recent versions of the Android operating system. While an initial patch was released for the high-severity flaw, a bypass was quickly developed, with a more comprehensive fix expected in a future security update.