Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
7 IOCs
Android 0-Day Vulnerability Exploited for Full Device Control
Threat Actors
Malware Families
Excerpt
Google has confirmed active exploitation of a high-severity Android zero-day vulnerability , CVE-2025-48595, in its June 2026 Android Security Bulletin published on June 1, 2026. The flaw resides in the Android Framework component. It enables local escalation of privilege through an integer overflow, requiring no user interaction or additional execution privileges, placing hundreds of millions of devices at immediate risk. CVE-2025-48595 is rooted in an integer overflow…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(1)
Victim
Attack Flow5 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2025-48595 | Medium | Score 54/100 | First seen |
| CVE | CVE-2025-48572 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-0040 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-48633 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-0041 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-0042 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-0039 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…