New Android Vulnerability ’Pixnapping’ Threatens Crypto Wallet Security

Cybersecurity researchers at Carnegie Mellon University have uncovered a sophisticated Android exploit capable of stealing cryptocurrency wallet seed phrases and 2FA codes directly from device screens. Dubbed 'Pixnapping,' the attack leverages GPU side-channel techniques to reconstruct sensitive pixel data without requiring special permissions.

The vulnerability specifically targets Google and Samsung devices, exploiting Android's graphical rendering pipeline through carefully timed VSync callbacks and window blur APIs. When users install malicious apps, attackers can silently invoke crypto wallets or authentication apps, then extract on-screen data pixel-by-pixel through timing analysis.

This represents a significant escalation in mobile security threats, as traditional app isolation barriers prove ineffective against the GPU.zip side-channel technique. The research team successfully demonstrated the attack on Google Pixel 6 devices, revealing how semi-transparent activity layers can expose color values of sensitive display elements.