Pixnapping Malware Exploits Android’s Rendering Pipeline to Steal Sensitive Data from Google and Samsung Devices

Cybersecurity researchers have revealed a new Android malware attack called Pixnapping, capable of stealing sensitive information from Google and Samsung smartphones without any user interaction. The name “Pixnapping” blends “pixel” and “snapping,” referring to how the malware stealthily extracts visual data pixel by pixel from targeted apps. 

When a user installs an app laced with the Pixnapping malware, it silently scans the device for other apps to spy on—such as Google Authenticator. Instead of opening the target app directly, the malware leverages the Android rendering pipeline to intercept the visual data being displayed. It then analyzes the color and content of individual pixels in areas known to display confidential information, like two-factor authentication (2FA) codes. By interpreting these pixels, the malware reconstructs the original data—essentially taking “invisible screenshots” of protected content without ever triggering normal app permissions. 

According to researchers, three flaws in Android’s design enable Pixnapping. First, apps can invoke another app’s activity through the rendering pipeline, which allows unauthorized access to refresh sensitive screens. Second, Android permits graphical operations to be performed on another app’s displayed content. Third, apps can detect pixel color changes during these operations, revealing the hidden visual data. 

Tests confirmed Pixnapping’s success across several devices, i

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.