A New Attack Lets Hackers Steal 2-Factor Authentication Codes From Android Phones
The malicious app required to make a "Pixnapping" attack work requires no permissions.
(Wired, 2025-10-14T21:40:00Z)