This new Android attack could let hackers swipe 2FA codes and snoop on private messages – ‘Pixnapping’ affects Samsung and Google smartphones, but experts warn more could be at risk

Researchers have uncovered a new class of Android attack based on a years-old data-stealing browser attack method.

The technique, dubbed Pixnapping by US-based researchers, allows attackers to stealthily steal sensitive information displayed by other apps or even websites without users ever realizing their data has been compromised.

This data can include two-factor authentication (2FA) codes, private messages, and even financial information.

In proof-of-concept tests, the team was able to recover sensitive information from widely used apps and websites such as Signal, Venmo, Google Authenticator, Gmail, Google Maps, and Google Accounts.

Notably, the malicious app was able to steal 2FA codes from Google Authenticator in less than 30 seconds, all without requiring any Android permissions or displaying suspicious activity to the user.

Pixnapping allows a malicious Android app to 'snap' pixels from other apps or websites by exploiting Android APIs and a GPU hardware side channel known as 'GPU.zip', which leaks information about how the graphics hardware processes visual data.

How Pixnapping attacks work

Pixnapping works in a three-stage process, with the first being invoking a target app, such as Google Authenticator, to cause sensitive information to be submitted for rendering.

The next step involves inducing graphical operations on individual sensitive pixels rendered by the target app - for example, the pixels that are part of the screen region where a 2FA character is known to be rendered by Google Authenticator.

A side channel such as GPU.zip is then used to steal the pixels operated on during step two, one pixel at a time. Steps two and three are repeated for as many pixels as needed to run optical character recognition over the recovered pixels and recover the original content.

The researchers demonstrated successful attacks on modern Google and Samsung phones, including the Pixel 6 through Pixel 9 ranges, and the Galaxy S25, running Android versions 13 through 16.

However, because the core mechanisms used by Pixnapping are typically available in all Android devices, the vulnerability is likely to affect a wide range of smartphones across manufacturers.

“Conceptually, it is as if any app could take a screenshot of other apps or websites without permission, which is a fundamental violation of Android’s security model,” said researcher Riccardo Paccagnella, assistant professor in Carnegie Mellon University’s Software and Societal Systems Department.

Initial patches failed to solve the issue

In February, the research team disclosed its findings to Google, which rated Pixnapping High Severity and began tracking it as CVE-2025-48561.

While Google attempted to mitigate the issue by restricting access to certain APIs, the research team said it later discovered a workaround that restored the attack’s effectiveness.

There's no evidence that the vulnerability has been exploited in the wild. However, as of October 13, researchers said Android remained vulnerable – although Google plans to issue an additional patch in its December Android security bulletin.

"Fixing Pixnapping will likely require changes to core Android mechanisms, for example, by allowing apps to prevent other apps from drawing over their sensitive content," said Paccagnella.

To prevent Pixnapping, the researchers recommend that users keep their Android devices updated with the latest patches as soon as they are released.

They plan to release Pixnapping’s source code once effective patches are available, to support further academic research and industry defenses.

Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.

MORE FROM ITPRO

• DNS Security 101: How to safeguard your business from cyber threats
• Why this Cybersecurity Awareness Month is particularly urgent
• How the channel can help enterprises short up supply chain security