Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
133 matching stories — in Mobile App Security — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
The Cyber Resilience Act (CRA) is a regulatory framework of the European Union (EU), which applies to both hardware and software products made available on the EU market. While the text entered into force on 10 December 2024, reporting obligations became active on 11 September 2026. This blog, while not exhaustive, aims to provide clarifications to mobile app developers and publishers as to the scope, deadlines, and compliance requirements of the CRA.
A recent investigation uncovered RemControl, an Android banking trojan designed to give attackers extensive control over compromised mobile devices. The malware combines remote access capabilities with techniques for stealing credentials, intercepting sensitive information, and manipulating device activity to support financial fraud. By operating directly on the victim’s device, attackers can monitor interactions with banking apps and potentially bypass security measures that rely on identifying
In a story recently reported by BuzzFeed, scammers are using calls and messages from seemingly legitimate mobile numbers to lure users with fake job offers before moving conversations to WhatsApp. Once there, attackers can repeatedly contact victims, send malicious links, and request personal information or money, highlighting how mobile messaging platforms are increasingly used for social engineering and fraud.
Since 11 September 2026, an actively exploited flaw in your app starts a 24-hour reporting clock under the EU's Cyber Resilience Act. That's expensive if you don't know what's running, and an edge if you do.
A recent report reveals that 90% of banking scam attempts now occur on mobile devices, highlighting the growing role of smartphones in financial fraud. Researchers found that scammers are increasingly exploiting mobile banking interactions through social engineering, impersonation, and deceptive communications to manipulate victims into authorizing fraudulent transactions. These attacks often rely on convincing users to act voluntarily, making them difficult to detect through traditional securit
A 2025 empirical study analyzing more than 500,000 Android APKs found that 92.5% of the top 1,000 Google Play apps in its 2023 dataset used some form of code obfuscation. Among apps ranked outside the top 30,000, that figure was 61.9%. The findings suggest that widely used applications are more likely to include obfuscation and […]
NowSecure's 2026 Mobile App Risk Management Survey found that 68% of organizations report having more than half their mobile codebase built from third-party SDKs. For most teams, the majority of what ships in their app is code they didn't write, and mobile app security testing hasn't caught up to that shift. Assessment practices haven't kept […] The post Most of Your Mobile Codebase Isn’t Yours. Are You Testing It Like It Is? appeared first on NowSecure.
Over the last week, multiple sources in Japan have identified a widening outbreak of data leaks via mobile API attacks. This includes detailed reports from an independent incident response team (JPCERT Coordination Center), analysis by security researchers at Macnica, a breach disclosure from one of the affected organizations (Park24), as well as multiple news stories from mainstream press in the region and international tech industry publications.
The modern world quickly became mobile-first oriented.Ninety-seven percent of Americans own a cell phone, and most people use their mobile devices to go online to bank, shop, and access personal information. With security threats on the rise (80% of malicious websites now target mobile devices), mobile application security testing has become the number one concern for developers and security researchers.
In mobile app security testing, we often overlook subtle yet critical issues such as data leakage in motion (over the air) and at rest (on the disk), misconfigurations, hardcoded credentials, and incorrect memory usage. These elusive vulnerabilities continue to undermine our apps' security. Just as rigorous training leads to victory in sports, each small step towards cleaner code enhances the overall security of mobile apps.
October is Cybersecurity Awareness Month, an annual initiative to remind us all to keep online security top of mind. The Cybersecurity and Infrastructure Security Agency (CISA), the federal agency responsible for helping protect U.S. critical infrastructure from cyber and physical threats, leads the campaign. Its 2026 theme, “Securing the Next 250,” connects the push to […]
Mobile applications face a growing range of security threats, from reverse engineering and code tampering to application repackaging, runtime manipulation, and unauthorised access. Mobile app ...
Cybersecurity Awareness Month usually brings a familiar set of reminders: strengthen passwords, turn on multifactor authentication, update software and watch for phishing. Each helps. None goes far enough for organizations whose customers, employees and revenue increasingly depend on mobile applications. The mobile security conversation changed materially in 2026. Enterprise mobile portfolios already include AI. Apple’s […] The post Cybersecurity Awareness Month 2026: 7 Mobile App Security
Financial institutions in Saudi Arabia now face concrete deadlines to prepare for quantum computing risks. With the Saudi Central Bank (SAMA) issuing new requirements in August 2026, financial institutions now have specific milestones to work toward, and the first one arrives before the end of this year.
Most mobile security incidents aren't caused by sophisticated zero-days. They're caused by ordinary mistakes that made it through code review because they don’t look dangerous in context. That might look like a key pasted into a config file during a sprint, a certificate check that only covers half the app's network calls, or an activity left exported because removing the flag might break something else. None of these issues would trip an obvious alarm for a human reviewer. However, all of them
PreEmptive has provided application shielding and hardening solutions for over 20 years, protecting .NET, MAUI, Java, Android, and JavaScript applications from reverse engineering, tampering, malware insertion, debugging, and runtime attacks. Dotfuscator for .NET and MAUI, DashO for Java and Android, and JSDefender for JavaScript integrate into development workflows to apply layered protection such as code […]
For most of the past decade, the authentication question banks asked was: Which method should we standardize on? Mobile apps provided a compelling answer, and most institutions converged on them. That question is now changing.
As security threats continue to evolve, modern security teams need to balance speed, visibility, and risk without slowing down development. Here’s a look at the key trends, tools, and practices shaping application security in 2026. The post [TEST] What Modern Security Teams Need to Know in 2026 appeared first on NowSecure.
Choosing the right type of electronic signature is only part of building a reliable signing process. Banks also need to consider how the signer is identified and authenticated, how consent and document integrity are protected, and how evidence can be verified over time.
Open source software has changed the way developers build mobile applications. Instead of creating everything from scratch, development teams can use existing libraries, frameworks and third-party ...
AI has lowered the cost of building mobile security tooling to near zero. However, it has not lowered the cost of operating it.
Why Annual Mobile App Security Testing Is Not Enough on Its Own Annual testing secures a moment. Your app keeps changing. Here is how to cover the interval between assessments.
Your app passed its security scan. But what happens after it reaches a device you don’t control? Security testing is essential before an application goes live. SAST, DAST and penetration testing can ...