A spyware family called SonicSpy was found on three apps available on the Google Play store as well as on more than 1,000 apps available on third-party app stores.

Mike Mimoso and Chris Brook discuss the news of the week including the return of the Mamba ransomware, APT trends, a mystery company’s 250K bug bounty, and a high schooler’s $10K bug bounty from Google.

Google awarded a hefty $10,000 bounty to a high school student last week for uncovering a bug that could have let anyone access an internal Google website.

Google’s August Android Security Bulletin featured patches for nearly a dozen remote code execution bugs impacting Google’s Pixel and Nexus handsets.

Google’s top Android engineer describes how the attack surface is shrinking on the mobile operating system.

A ransomware study released Google revealed the malware earned criminals $25 million over the past two years.

The Tor Project is launching a public bug bounty program to encourage security researchers to responsibly report issues they find in the software.

Cloudflare and network operator Credo Mobile suffered a legal defeat when U.S. appeals court ruled to uphold a gag order on FBI surveillance data.

Google has a new machine-learning algorithm it uses to compare new apps to known secure apps, improving the way it classifies submissions to Google Play.

Google has put websites signed with WoSign/StartCom SSL certificates on notice that it will no longer trust certs from the Chinese CA starting in Chrome 61.