Connect with us

Latest

Android flaw lets hackers unlock phones in under a minute

Published

on

Your phone lock screen is supposed to be your last line of defense. If your device gets lost or stolen, that PIN or passcode should keep strangers out of your photos, messages and financial apps. But researchers have found a serious flaw that can break through those protections on certain Android phones in less than a minute.

Once exploited, attackers can recover your phone’s PIN, unlock encrypted storage and even extract sensitive data such as cryptocurrency wallet seed phrases. Security researchers estimate that roughly one in four Android phones could be affected, particularly budget phones.

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com –  trusted by millions who watch CyberGuy on TV daily. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.  

ANDROID FIXES 129 SECURITY FLAWS IN MAJOR PHONE UPDATE

A newly disclosed vulnerability, tracked as CVE-2026-20435 in the National Vulnerability Database, affects some Android phones powered by MediaTek, a major smartphone chip maker based in Taiwan that competes with companies like Qualcomm. These phones use a security component called Trustonic’s Trusted Execution Environment (TEE), which is designed to keep sensitive data, such as encryption keys, protected from the rest of the system.

It stores cryptographic keys that help keep your device encrypted and secure, even if someone tries to tamper with it. However, security analyses of the vulnerability indicate that these protections may be bypassed on affected devices.

By connecting a phone to a computer using a USB cable, an attacker with physical access may be able to exploit the flaw during the early boot process, potentially exposing sensitive data before full security protections are enforced. Think of it like accessing the master key before the safe door even closes. Once attackers gain access to these low-level components, they may be able to access encrypted storage without needing your PIN.

In a worst-case scenario, this type of access could allow attackers to extract highly sensitive information, including personal photos, stored passwords, private messages, financial data, and crypto wallet credentials. If seed phrases for crypto wallets are exposed, attackers could drain funds permanently.

There’s limited action manufacturers can take on their own since the issue originates at the processor level, which is manufactured by MediaTek. The company says it has released a firmware patch addressing the vulnerability. However, the update must still be distributed by individual phone manufacturers through security updates. Depending on the device and whether it is still supported, that update could arrive quickly or not at all.

The good thing is that this attack requires physical access to the phone and a USB connection to a computer. That means it cannot be done remotely over the internet. However, if your phone is stolen, briefly confiscated, or even taken during a repair, the attacker could potentially extract sensitive information.

If you’re not sure whether this vulnerability affects your mobile device, you can look up your phone on a platform like GSMArena or your vendor’s website to see which SoC it uses, then cross-check it with MediaTek’s March security bulletin under CVE-2026-20435. You can log onto corp.mediatek.com/product-security-bulletin/March-2026 to review the list of affected chipsets and confirm whether your device may be at risk.

CyberGuy reached out to MediaTek for comment, but did not hear back before our deadline.

NEW ANDROID ATTACK TRICKS YOU INTO GIVING DANGEROUS PERMISSIONS

So how do you know if your phone is actually at risk? Not every Android phone is vulnerable. The issue primarily affects devices that use certain MediaTek processors. Here’s how to check your phone:

Go to Settings > About phone and look for your exact model name.

Search your phone model on a site like GSMArena or your manufacturer’s website to find the processor (also called the SoC).

If your phone uses a MediaTek chip, it may be affected. Devices with Qualcomm Snapdragon or Google Tensor chips are not part of this specific issue.

Check your phone’s system update settings and install any available updates from your manufacturer.  Go to Settings > Software update and install any available updates. MediaTek has already released a fix, but phone makers must distribute it. Installing updates quickly ensures you receive the firmware patch if your device manufacturer has released it.

If your phone uses one of the affected chips, a few simple precautions can help reduce the chances of someone accessing your data if the device ever falls into the wrong hands.

A security app cannot fix this processor-level flaw. However, it can still help protect your phone from other threats that often follow stolen or compromised devices. It will not stop this specific exploit, but it can detect malicious apps, spyware, and suspicious activity that attackers may install after gaining access. That extra layer of monitoring can help stop additional data theft if your device ever falls into the wrong hands. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

If you store things like cryptocurrency wallet seed phrases, recovery codes, or sensitive documents in notes apps or screenshots, consider moving them to a secure offline location. If someone extracts your phone’s data through this vulnerability, that information could be exposed.

This exploit requires someone to physically connect your phone to a computer. Do not leave your device unattended in public places, and be cautious when handing it to repair shops or unknown technicians. Physical access dramatically increases the risk.

While the vulnerability bypasses encryption on affected devices, strong lock settings still protect against many other threats. Use a longer PIN or passcode instead of simple patterns, and enable automatic locking after short periods of inactivity.

Even if attackers gain access to data on your phone, two-factor authentication (2FA) can stop them from logging into your online accounts. Enable it for email, banking apps, cloud storage, and social media wherever possible.

A password manager stores your login credentials in a secure, encrypted vault instead of leaving them scattered across apps and notes. If someone compromises your device, the password manager still protects your accounts with strong encryption, forcing attackers to break through another security layer before they can access your logins. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

Some Android devices limit USB data access when locked. Turning on this setting can reduce the risk of unauthorized data extraction through a wired connection, especially in situations where someone briefly gains physical access to your phone. On Samsung phones running the latest software:

Settings may vary slightly depending on your Samsung model and software version.

Go to Settings

Tap Lock screen

Then, tap Secure lock settings

Enter your current PIN, then tap Continue

Enable “Lock network and security” (or a similarly named option) to help block USB data access while your device is locked.

This vulnerability exposes a deeper issue with the Android ecosystem. Even when chipmakers release a fix, millions of phones depend on manufacturers to deliver updates that may never arrive, especially for cheaper devices that lose support quickly. We often assume our lock screen and encryption will protect our data if a phone is lost or stolen. However, incidents like this show that protection is only as strong as the update policies behind it. When devices stop receiving security patches, those protections quietly weaken over time.

Should phone manufacturers be required to guarantee security updates for several years if their devices contain critical encryption vulnerabilities? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com –  trusted by millions who watch CyberGuy on TV daily. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Copyright 2026 CyberGuy.com.  All rights reserved.  

Continue Reading

Latest

Sinister Code Appears on National Mall Days Before Trump’s 250 Celebration

Published

on

Sinister Code Appears on National Mall Days Before Trump’s 250 Celebration

A disturbing act of vandalism has appeared on one of America’s most historic landmarks just weeks before President Donald Trump is set to lead celebrations commemorating the nation’s 250th anniversary.

Authorities were called to the National Mall in Washington, D.C., after the numbers “8647” were discovered burned into the grass near the World War II Memorial and the Lincoln Memorial Reflecting Pool. Federal officials say the incident is being treated seriously given the increasingly charged political climate and the controversial meaning many associate with the phrase.

Photographs from the scene showed the scorched markings stretching across a section of lawn on the western end of the National Mall. The burned-out brown grass stood in sharp contrast to the surrounding green landscape, making the message clearly visible to visitors and authorities alike.

The timing of the vandalism has raised concerns because it comes just before a series of major patriotic events planned by the Trump administration to celebrate America’s semiquincentennial, marking 250 years since the nation’s founding. A massive 16-day “Great American State Fair” is scheduled to begin June 25 and continue through Independence Day festivities on July 4.

President Trump has personally championed many of the anniversary celebrations and has also pushed restoration efforts at several iconic landmarks in the nation’s capital, including improvements to the Lincoln Memorial Reflecting Pool located near the site of the vandalism.

The phrase “8647” has become increasingly controversial in recent years. While some defenders claim the term is merely political expression, many Trump supporters and administration officials argue that it has become widely understood as a reference to removing—or worse—President Trump, the 47th president of the United States. The number “86” has long been used as slang meaning to eliminate, get rid of, or remove something.

The slogan gained national attention earlier this year when former FBI Director James Comey came under fire for posting an image showing seashells arranged to display the numbers “8647.” The post generated immediate backlash and sparked accusations that the former FBI chief was promoting a message that could be interpreted as encouraging violence against the president.

Comey later removed the post and claimed he was unaware that many viewed the phrase as a call for violence. He has maintained that his actions were protected under free speech principles and has denied any malicious intent.

In response to the latest incident, White House officials strongly condemned the vandalism.

White House spokesman Davis Ingle told the Daily Mail: “Anyone who engages in or endorses political violence or assassination culture must be condemned in the harshest terms possible.”

He continued: “They should also immediately seek psychiatric help to treat their severe and debilitating case of Trump Derangement Syndrome that has warped their brains and made them sick in the head.”

The Department of the Interior echoed those concerns and vowed accountability for whoever is responsible.

“The deranged vandalism on our National Mall will not be tolerated. Any threat against the President is taken very seriously by the Department, and our US Park Police will investigate this incident and hold those responsible accountable.”

Witnesses observed U.S. Park Police officers and National Guard personnel examining the area Thursday as investigators worked to determine how the markings were created and who may be responsible.

The incident highlights growing concerns about increasingly hostile political rhetoric directed toward President Trump. Just one year after surviving two assassination attempts during the 2024 campaign, many supporters view displays such as the “8647” message as more than simple vandalism.

With millions of Americans expected to travel to Washington for the nation’s historic 250th anniversary celebration, federal authorities are expected to maintain heightened security throughout the upcoming events.

As investigators search for answers, administration officials are making clear that threats, intimidation, and politically motivated vandalism will not overshadow America’s birthday celebration—or deter President Trump from leading it.

Continue Reading

Latest

Sickening Spending Of Karmelo Anthony’s Family Found As Fundraiser Gets Shut Down

Published

on

Sickening Spending Of Karmelo Anthony’s Family Found As Fundraiser Gets Shut Down

Just days after being convicted of murdering Texas high school student Austin Metcalf and receiving a 35-year prison sentence, Karmelo Anthony is now claiming he is too poor to afford legal representation for his appeal—a claim raising serious questions given the hundreds of thousands of dollars raised in his name over the past year.

Anthony, 19, was convicted Tuesday for the fatal stabbing of 17-year-old Austin Metcalf during a confrontation at a high school track meet in Frisco, Texas. The case drew national attention and sparked intense public debate after Anthony claimed he acted in self-defense, an argument ultimately rejected by the jury.

Following his conviction, Anthony quickly filed a notice of appeal seeking to challenge the verdict. However, court documents obtained by local media reveal that Anthony is now asking the court for assistance, claiming he lacks the financial resources necessary to hire an attorney.

In the filing, Anthony described himself as a “penniless, destitute, and indigent person, too poor to employ counsel to represent me on the appeal.”

The claim has generated renewed scrutiny because Anthony’s family previously benefited from an online fundraising campaign that brought in an enormous amount of money following the fatal stabbing.

The GiveSendGo fundraiser, titled “Help Karmelo Official Fund,” reportedly raised nearly $634,000 before being removed from the crowdfunding platform. The campaign was launched on April 15, 2025, less than two weeks after the deadly incident that took Austin Metcalf’s life.

The fundraising effort originally sought to collect nearly $1.4 million and received donations from supporters across the country. According to the campaign description, the money was intended for more than legal expenses.

“While legal defense is a critical part of this journey, we want to make it clear that this fund is not solely dedicated to legal expenses. The funds raised will also support a range of urgent and necessary means that have emerged as a result of the situation, including – but not limited to – the safe relocation of the Anthony family due to escalating threats to their safety and well-being, as well as basic living costs, transportation, counseling, and other security measures.”

Questions remain about exactly how the funds were spent and whether any portion remains available to assist with Anthony’s appeal.

The fundraiser’s removal also generated attention online. GiveSendGo addressed the decision in a public statement, explaining that the campaign had effectively completed its mission.

“The fundraiser was created to support pre-trial needs, and those funds were dispersed over the past year for lawful purposes, including legal defense and family relocation with that stated purpose now complete the fundraiser has been closed. Our policy is that a fundraiser stated purpose stays accurate so givers always know what they are supporting.”

The platform did not provide a detailed accounting of how the money was distributed, nor did it indicate whether any funds remained under the control of Anthony or his family.

Meanwhile, reports indicate that another fundraising effort has emerged on behalf of the Anthony family. The new campaign was reportedly organized by Dominique Alexander, a Dallas-area activist and minister who frequently appeared as a spokesman for the family throughout the legal proceedings.

The conviction marked the conclusion of one of the most closely watched criminal trials in Texas in recent years. Prosecutors argued that Anthony’s actions were unjustified and presented evidence showing that Metcalf was unarmed when he was stabbed. The jury ultimately sided with the prosecution and delivered a guilty verdict.

For many observers, Anthony’s claim of financial hardship has become one of the latest controversial developments in a case that has already generated widespread public outrage. While he pursues an appeal from prison, critics are questioning how someone connected to a fundraising effort that collected nearly $634,000 can now claim to be unable to afford legal counsel.

The appeal process will move forward in the coming months, but Anthony’s assertion that he is “penniless” is likely to remain a major point of public debate as the case continues to unfold.

Continue Reading

Latest

‘Guilty As Hell’: Dems Panic After Alarming Discovery On Capitol Hill

Published

on

‘Guilty As Hell’: Dems Panic After Alarming Discovery On Capitol Hill

The walls may be closing in on one of the Democratic Party’s most powerful fundraising operations.

ActBlue CEO Regina Wallace-Jones stunned lawmakers Wednesday when she repeatedly invoked her Fifth Amendment right against self-incrimination during a congressional hearing investigating allegations that the Democrat fundraising giant may have accepted potentially illegal foreign donations.

The hearing, led by House Republicans, focused on mounting concerns surrounding ActBlue’s fundraising practices and whether the platform failed to stop suspicious donations from foreign sources. ActBlue serves as the primary online fundraising hub for Democratic candidates and progressive causes, processing billions of dollars during the 2024 election cycle.

What should have been a straightforward opportunity for Wallace-Jones to reassure lawmakers quickly turned into a spectacle as she refused to answer question after question under oath.

Rep. Jim Jordan (R-OH), chairman of the House Judiciary Committee and one of the leading investigators examining ActBlue’s operations, directly challenged the CEO about allegations that the organization accepted millions of questionable donations.

The exchange quickly became one-sided.

“Your board chairman said ActBlue accepted up to 38 million contributions in 2024 that had the signs of foreign origin. How much fraud is too much fraud?” Jordan asked.

“On the advice of counsel, I respectfully declined to answer the question pursuant to my Fifth Amendment rights under the Constitution,” Wallace-Jones responded.

Jordan continued pressing for answers.

“How many foreign contributions did ActBlue accept?”

“On the advice of counsel, I respectfully declined to answer the question pursuant to my Fifth Amendment rights under the Constitution.”

“How much money did ActBlue accept from Russia?”

“On the advice of counsel, I respectfully declined to answer the question pursuant to my Fifth Amendment rights under the Constitution.”

Jordan then turned to the growing turmoil inside the company.

“Why did your entire legal team quit? Your in-house legal team?”

“On the advice of counsel, I respectfully declined to answer the question pursuant to my Fifth Amendment rights under the Constitution.”

“Did your legal team quit because of reduced fraud standards?”

“On the advice of counsel, I respectfully declined to answer the question pursuant to my Fifth Amendment rights under the Constitution.”

Finally, Jordan delivered one of the most direct questions of the hearing.

“Did you weaken your fraud standards to help Democrats?”

“On the advice of counsel, I respectfully declined to answer the question pursuant to my Fifth Amendment rights under the Constitution.”

By the end of the hearing, Wallace-Jones had invoked the Fifth Amendment 22 separate times.

The controversy surrounding ActBlue extends far beyond a single hearing. According to congressional investigators, five other ActBlue employees previously invoked the Fifth Amendment a combined 146 times during depositions. A joint interim staff report produced by the House Administration, Judiciary, and Oversight Committees alleged evidence of illicit foreign donations and what investigators described as a subsequent cover-up inside the organization.

The report also detailed a wave of resignations and dismissals within ActBlue’s legal and compliance departments following the 2024 election, raising further questions about what company insiders knew and when they knew it.

Federal law strictly prohibits foreign nationals from contributing to American political campaigns. These safeguards exist to protect the integrity of U.S. elections and prevent foreign governments or outside actors from influencing the political process through financial contributions.

Republican investigators argue that ActBlue’s verification systems may have been insufficient to prevent suspicious donations from entering the Democratic fundraising pipeline. Concerns have centered on donations linked to foreign IP addresses, prepaid debit cards, and potential straw donor schemes.

Critics note the irony that many Democrats spent years warning Americans about foreign election interference while now facing serious questions about whether foreign money may have flowed through their own fundraising infrastructure.

Adding fuel to the controversy, reports indicate that some of ActBlue’s own attorneys raised concerns internally regarding fraud detection and donor verification procedures. The departure of key legal and compliance personnel has only intensified scrutiny from lawmakers.

While invoking the Fifth Amendment is a constitutional right and does not constitute an admission of guilt, the optics of a CEO refusing to answer basic questions about foreign donations, fraud controls, and internal resignations are likely to deepen public skepticism.

For Republicans, the hearing represents yet another step toward uncovering what they believe could be one of the largest campaign finance scandals in recent memory. With congressional investigations continuing and additional records expected to be reviewed, pressure on ActBlue appears unlikely to ease anytime soon.

As lawmakers seek answers about suspicious donations and potential foreign influence, Wallace-Jones’s repeated refusal to address the allegations has only amplified calls for greater transparency from the Democratic Party’s fundraising powerhouse.

Continue Reading

Trending

Copyright © 2026 Political Signal