Some Android phones can be fully decrypted in ~45 seconds.
Researchers from @Ledger Donjon team discovered a flaw in parts of MediaTek’s secure boot chain.
With physical access and just a USB cable, attackers can:
• Dump encryption keys before Android boots
• Decrypt the entire phone storage
• Brute-force the lock PIN offline
• Extract crypto wallet seed phrases
The proof-of-concept was demonstrated on the Nothing CMF Phone 1.
Wallets tested included:
• Trust Wallet
• Kraken Wallet
• Phantom
• Rabby
• Base
MediaTek issued a firmware patch earlier in 2026, but devices are only protected if the manufacturer ships the update.
Many budget and mid-range phones using MediaTek chips could be affected.
Update your device.
Source : Bitget
Someone sent me a DM asking if a weird Minecraft thingie was malware (pinkiecraft(dot)com). I poked it with a stick
> pinkiecraft(dot)com
> vibe coded site
> "installer" for "program" is .rar
> extract .exe from .rar
> .exe is normal installer
> open installer
> .exe and uninstaller (normal)
> look at .exe
> big af
> look inside
> electron app (.js to .exe)
> look inside
> NSIS
> app-64.7z
> open app-64.7z
> pinkiecraft.exe
> look inside
> electron js (again)
> open .exe with .7z
> app.asar (electron js)
> extract
> npm extract app.asar
> look inside
> program heavily obfuscated
> contains "scripts" folder
> lots of js dependencies for https and sqlite
> scripts/discord-injection-obf
> lolwtf
> bonk with stink
> aes256 encrypted (lolwtf?)
> decrypts using similar technique as chrome passwords
> split password into fragments
> "su" + "per" + "pa" + "ss" + "word"
> aes256 master big ass base64 blob
> ok lolwtf
> bonk with really big stick (annoying me)
> decrypt
> checks if on windows
> kills discord with "taskkill /F /IM Discord.exe"
> modifies discord on pc
> injects scripts/discord-injection-obf into discord
> restarts discord
> discord now running discord-injection-obf
> discord-injection-obf heavily obfuscated
> checks email, password, 2fa
> sends your data to website they made
> network-sync-protocol(dot)net/api/send
tl;dr tl;dr
> pinkiecraft.exe
> kill discord
> inject discord with dumb .js file
> restart discord
> discord work ok still
> js inside discord steal your email and password
❗️🎮 A hobbyist accidentally hacked EVERY DJI RoboVac by extracting his own private token, gaining the ability to remotely control the entire DJI fleet and view all their video streams.
All he wanted was to control his new DJI RoboVac with a PS5 gamepad.
He skipped responsible disclosure and published the vulnerability before it was patched, stating:
"I don't follow the rules (...) for money. I f***ing don't care, I just want this fixed."