Pixnapping: The 2025 Android Vulnerability Stealing MFA Codes Pixel by Pixel
Executive Summary
In October 2025, researchers unveiled a new Android vulnerability called 'Pixnapping,' enabling malicious applications with zero special permissions to exfiltrate sensitive screen data—such as multi-factor authentication (MFA) codes, chat messages, and emails—pixel by pixel via a GPU-based side-channel attack. The attack exploits the way Android's SurfaceFlinger composes app windows and leverages a graphics compression side-channel (GPU.zip) to reconstruct sensitive on-screen information. Pixnapping affects modern and fully patched Android 13–16 devices from Google and Samsung, and researchers demonstrated that 2FA codes could be exfiltrated in under 30 seconds, while more extensive data (such as chat logs) could be compromised within hours. Although Google attempted a patch in September, an effective fix is only expected in the December 2025 Android update, with GPU vendors yet to announce mitigation plans.
This incident underscores a growing trend in side-channel and screen-based attacks, reflecting how even trusted software stacks and hardware abstraction layers can be used to bypass isolation. The Pixnapping method exposes the gaps in mobile OS zero-trust models—and with rising adoption of MFA and privacy-driven apps, the risk to enterprises and consumers is heightened.
Why This Matters Now
Pixnapping demonstrates the urgent reality that even permissionless Android apps can compromise high-value personal and enterprise data, defeating existing security boundaries. As mobile devices become primary endpoints for authentication and sensitive transactions, flaws in GPU and OS design present immediate risk, especially before the December security update becomes widely available.
Attack Path Analysis
The attack began when a user installed a malicious Android app exploiting the Pixnapping side-channel, gaining access via misusing Android's intents system without requiring explicit permissions. The app leveraged those intents to interact with other apps and surface overlays, escalating its access to sensitive data views. Using graphical overlay techniques, the malware isolated and mapped pixels of sensitive data (such as MFA codes) through cross-app lateral interaction. The app covertly communicated with an external attacker server, facilitating controlled extraction of reconstructed secrets. Using network connectivity, the malicious app exfiltrated these pixel-derived data to an external location. Ultimately, the attacker compromised the confidentiality of MFA codes and private messages, enabling potential secondary account breaches or impersonation.
Kill Chain Progression
Initial Compromise
Description
User installs a malicious app that abuses the Android intents system and a GPU side-channel vulnerability (Pixnapping) to initiate an attack without needing permissions.
Related CVEs
CVE-2025-48561
CVSS 5.5A side-channel information disclosure vulnerability in the Android Framework allows a local malicious application to access sensitive data displayed on the screen without requiring additional execution privileges or user interaction.
Affected Products:
Google Android – 13.0, 14.0, 15.0, 16.0
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Application Window Discovery
User Execution
Steal Application Access Token
Input Capture: Keylogging
Screen Capture
Obfuscated Files or Information
Steal Web Session Cookie
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Protect Stored Account Data
Control ID: 3.2.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA (EU Digital Operational Resilience Act) – ICT Risk Management Framework
Control ID: Art. 9
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Device Visibility and Control
Control ID: Pillar: Devices, Maturity: Initial
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
PCI DSS 4.0 – Address Vulnerabilities and Patch Management
Control ID: 6.4.2
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Mobile malware Pixnapping attack critically threatens MFA authentication systems, enabling pixel-by-pixel extraction of 2FA codes from banking apps within 30 seconds.
Health Care / Life Sciences
Android Pixnapping vulnerability exposes patient communications and authentication credentials in healthcare apps, violating HIPAA compliance requirements for data protection.
Government Administration
Government mobile applications vulnerable to side-channel attacks stealing sensitive credentials and communications, compromising national security and citizen data protection.
Information Technology/IT
IT sector faces widespread Android device compromise through Pixnapping attacks targeting authentication systems, requiring immediate security fabric upgrades and patches.
Sources
- New Android Pixnapping attack steals MFA codes pixel-by-pixelhttps://www.bleepingcomputer.com/news/security/new-android-pixnapping-attack-steals-mfa-codes-pixel-by-pixel/Verified
- Pixnapping Attackhttps://www.pixnapping.com/Verified
- Android Security Bulletin—September 2025https://source.android.com/security/bulletin/2025-09-01Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Enforcing Zero Trust principles—especially strong segmentation, egress controls, and traffic inspection—can restrict a malicious app’s opportunity to communicate with sensitive workloads or exfiltrate data. CNSF capabilities like microsegmentation, east-west security, centralized visibility, and egress enforcement would have detected or contained key stages of this attack.
Control: Multicloud Visibility & Control
Mitigation: Improved threat surface visibility would accelerate detection of anomalous app deployments or unexpected flows.
Control: Zero Trust Segmentation
Mitigation: Microsegmentation of workload and app interactions limits indirect lateral access and reduces blast radius.
Control: East-West Traffic Security
Mitigation: Restricts privilege creep and inter-app communication with strong east-west isolation controls.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound C2 attempts can be detected, blocked, or alerted on via policy-based FQDN and traffic filtering.
Control: Cloud Firewall (ACF) + Inline IPS (Suricata)
Mitigation: Network-based perimeter and inline intrusion prevention blocks or detects anomalous outbound data transfers.
Anomalous authentication activity can be detected post-breach, enabling rapid response.
Impact at a Glance
Affected Business Functions
- User Authentication
- Secure Communications
- Financial Transactions
Estimated downtime: N/A
Estimated loss: N/A
Potential exposure of sensitive information such as two-factor authentication codes, private messages, and financial data displayed on the screen.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation and east-west controls to confine app-level threats and stop lateral data access on endpoints and in the cloud.
- • Enforce strict egress filtering and FQDN policy to block unauthorized outbound connections from workloads and mobile endpoints.
- • Leverage centralized multicloud visibility to rapidly detect and investigate unapproved or anomalous app behaviors across hybrid environments.
- • Deploy cloud-native firewalls and inline IPS solutions to inspect network traffic for signature-based threats and prevent sensitive data exfiltration.
- • Continuously baseline environment activity and enable automated anomaly detection for early warning on privilege misuse, command-and-control, or aggressive exfiltration patterns.
