![\"The](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2025\/10\/1760528287_434_960x0.jpg\")
<\/p>\n<\/p>\n
New attack steals Android 2FA codes in 30 seconds flat.<\/p>\n
NurPhoto via Getty Images<\/p>\n
A stealthy new Android attack has been confirmed that can steal two-factor authentication codes in almost no time at all, just 30 seconds flat, in fact. Here\u2019s everything you need to know about the Pixnapping threat, including Google\u2019s response. Spoiler alert: you\u2019ll have to wait until December for Google to issue a security update.<\/p>\n
The Pixnapping Android Attack Threat \u2014 What You need To Know<\/p>\n
Following a collaboration between security researchers from the University of California, Berkeley, the University of Washington, University of California, San Diego and Carnegie Mellon University, it has been confirmed that certain Google Pixel and Samsung Galaxy smartphones can be hacked using a Pixnapping attack that gobbles up 2FA codes in less than 30 seconds. <\/p>\n
Although the researchers only tested the attack against specific Google Pixel and Samsung Galaxy phones, that doesn\u2019t mean you are safe if you use a different smartphone. \u201cThe core mechanisms enabling the attack are typically available in all Android devices,\u201d the researchers have warned<\/a>. <\/p>\n ForbesGoogle Confirms Gmail Encryption Update \u2014 What You Need To KnowBy Davey Winder<\/a><\/p>\n So, what is Pixnapping? According to Christopher Fletcher, Pranav Gopalkrishnan, David Kohlbrenner, Riccardo Paccagnella, Hovav Shacham, Alan Wang and Yingchen Wang, the researchers behind the alert, Pixnapping induces \u201cgraphical operations on individual sensitive pixels rendered by the target app,\u201d an app such as, say, Google Authenticator, that are then stolen, one by one, using a side-channel process. In simple terms, it effectively takes a screenshot without actually having to do so. Pixnapping targets the pixels in the part of the screen where Google Authenticator is known to render 2FA code responses, and meticulously recovers them to form the complete picture of your authentication code, in less than 30 seconds. <\/p>\n What is most worrying is that a Pixnapping attack can be executed by any running Android app, the researchers warned, \u201ceven if it does not have any Android permissions.\u201d Things also look pretty bad when you consider that the Pixnapping research paper<\/a> reveals that anything visible can be targeted by this attack, including chat and email messages.<\/p>\n On the positive flipside, secret information that is not displayed cannot be exfiltrated by the pixnapping technique. And that\u2019s not where the good news stops either: this attack requires the installation of a malicious app in the first place.<\/p>\n Which Android Devices Are At Risk?<\/p>\n Although, as already mentioned, most any Android device could be impacted by a Pixnapping attack, the following smartphones were found to be vulnerable during the research:<\/p>\n Google Pixel 6 The devices were running Android 13 to 16.<\/p>\n
Google Pixel 7
Google Pixel 8
Google Pixel 9
Samsung Galaxy S25<\/p>\n