Pixnapping Attack Hijacks Google Authenticator 2FA Codes in Under 30 Seconds

Cybersecurity: Pixnapping Attack Technique

Security researchers have identified a new attack method called "Pixnapping," which can extract two-factor authentication (2FA) codes from Google Authenticator and other sensitive mobile applications in less than 30 seconds.

Pixnapping exploits Android's graphics rendering system to create a side-channel attack that extracts pixel data from victim applications. Unlike traditional browser-based attacks, Pixnapping uses Android intents to launch applications and overlays semi-transparent attacker-controlled activities on top.

The vulnerability, designated as CVE-2025-48561, is a significant advancement in pixel-stealing attacks, bypassing modern browser security and affecting Android devices from multiple manufacturers.

Pixnapping operates through three main steps:

The attacker app sends Android intents to open activities from victim applications. Semi-transparent activities are layered to manipulate individual victim pixels through masking and encoding techniques. The attack measures rendering time differences caused by GPU optimizations to extract pixel color information.

Researchers demonstrated the attack on Google Pixel 6, 7, 8, and 9 devices, as well as Samsung Galaxy S25 phones. The leakage rates varied between 0.15 and 2.11 pixels per second, depending on the device.

Pixnapping can steal 2FA codes from Google Authenticator before they expire. The optimized technique identifies digits by leaking a few pixels per digit, achieving a 53-73% success rate in recovering six-digit codes within 30 seconds.

On Google Pixel devices, extraction times ranged from 14.3 to 25.8 seconds, with Pixel 6 performing the fastest. The attack operates without special Android permissions and remains covert by hiding malicious activity under a slightly transparent layer.

Beyond 2FA codes, Pixnapping can extract sensitive data such as:

Google Maps Timeline location histories Private Signal messages SMS conversations from Google Messages Venmo account balances and transaction details Gmail inbox contents Google Account personal information

The attack circumvents browser-based protections that mitigate traditional pixel-stealing methods. A survey revealed that 100% of websites are vulnerable when accessed via the Chrome browser app.

Researchers disclosed their findings to Google on February 24, 2025, receiving a high severity rating. Google released an initial patch on September 2, 2025, but it did not fully protect Samsung devices. Follow-up disclosures occurred in September, with ongoing coordination for comprehensive mitigations as of October 13, 2025.

Recommendations include restricting transparent layering over applications with an explicit allowlist, preserving the collaborative design of Android app layering while protecting against pixel extraction.

Based on reporting by GBHackers.