Back to today’s briefing

Story perspectives

New Pixnapping Attack Steals 2FA Codes in Seconds

10/13/2025

48 9

Summary

Story summary

Pixnapping attack, a newly identified Android threat, can steal 2FA codes and location data from apps such as Google Authenticator and Gmail in under 30 seconds.
The attack exploits Android vulnerabilities by using the GPU to access screen pixels without requiring special permissions.
Google has released patches, but modified Pixnapping versions can bypass mitigations, and researchers from several universities continue to work toward full fixes.

1 of 1

Story summary

Pixnapping attack, a newly identified Android threat, can steal 2FA codes and location data from apps such as Google Authenticator and Gmail in under 30 seconds.
The attack exploits Android vulnerabilities by using the GPU to access screen pixels without requiring special permissions.
Google has released patches, but modified Pixnapping versions can bypass mitigations, and researchers from several universities continue to work toward full fixes.