Security

Android SDK Vulnerability Exposed Millions of Wallets

3 min read

Summary

Microsoft disclosed a severe intent redirection flaw in the third-party EngageSDK for Android, putting millions of crypto wallet users at potential risk of data exposure and privilege escalation. The issue was fixed in EngageSDK version 5.2.1, and the case highlights the growing security risk of opaque mobile app supply-chain dependencies.

Audio Summary

0:00--:--
Need help with Security?Talk to an Expert

Introduction

Microsoft has disclosed a severe Android security issue in a widely used third-party library, EngageSDK. While the flaw was not found to be exploited in the wild, it affected apps installed at massive scale and serves as a reminder that third-party SDKs can quietly introduce major supply-chain risk into otherwise trusted mobile apps.

What happened

The vulnerability is an intent redirection flaw in EngageSDK, a library used for messaging and push notifications in Android apps.

Key details include:

  • The issue allowed a malicious app on the same device to abuse the vulnerable app’s trusted context.
  • This could potentially lead to unauthorized access to protected components, sensitive data exposure, and privilege escalation.
  • Microsoft said more than 30 million installations of third-party crypto wallet apps alone were potentially exposed to risk.
  • The flaw was traced to an exported Android activity, MTCommonActivity, added through the SDK during the build process.
  • Because it appears in the merged manifest post-build, developers may miss it during normal review.

Microsoft coordinated disclosure with EngageLab and the Android Security Team. The issue was resolved in EngageSDK version 5.2.1 on November 3, 2025.

Why this matters for security teams

This disclosure is important beyond Android wallets. It shows how:

  • Third-party SDKs can expand the attack surface without clear visibility
  • Exported components can create unintended trust boundaries between apps
  • Mobile app supply-chain weaknesses can affect millions of users at once

Android has also added platform-level mitigations for this specific EngageSDK risk, and apps detected as vulnerable were removed from Google Play. Microsoft noted that users who had already downloaded vulnerable apps now have additional protection.

Impact on administrators and developers

For security administrators, this is a strong example of why mobile application governance must include dependency review, not just app reputation or store approval.

For developers and DevSecOps teams, the biggest lessons are:

  • Review merged Android manifests, not only source manifests
  • Audit exported activities and other exposed components
  • Validate intent handling and cross-app trust assumptions
  • Track third-party SDK versions as part of software supply-chain management
  • Upgrade EngageSDK immediately to version 5.2.1 or later if it is present in any Android apps.
  • Review mobile apps for exported components added by dependencies.
  • Add dependency and manifest analysis to CI/CD security checks.
  • Use Microsoft’s detection guidance and indicators from the original advisory to assess exposure.

This incident reinforces a broader point: mobile security is increasingly shaped by the libraries apps depend on, not just the code developers write directly.

Need help with Security?

Our experts can help you implement and optimize your Microsoft solutions.

Talk to an Expert

Stay updated on Microsoft technologies

Read the original article by Microsoft Defender Security Research Team
Android securitymobile app securitythird-party SDKcrypto walletsMicrosoft Defender

Related Posts

Security

Storm-2755 Payroll Attacks Hit Canadian Employees

Microsoft has detailed a financially motivated Storm-2755 campaign targeting Canadian employees with payroll diversion attacks. The threat actor used SEO poisoning, malvertising, and adversary-in-the-middle techniques to steal sessions, bypass legacy MFA, and alter direct deposit details, making phishing-resistant MFA and session monitoring critical defenses.

Security

DNS Hijacking Attacks via SOHO Routers: Microsoft Warns

Microsoft Threat Intelligence says Forest Blizzard has been compromising vulnerable home and small-office routers to hijack DNS traffic and, in some cases, enable adversary-in-the-middle attacks against targeted connections. The campaign matters to IT teams because unmanaged SOHO devices used by remote and hybrid workers can expose cloud access and sensitive data even when corporate environments remain secure.

Security

Medusa Ransomware: Storm-1175 Targets Web Assets

Microsoft Threat Intelligence warns that Storm-1175 is rapidly exploiting vulnerable internet-facing systems to deploy Medusa ransomware, sometimes within 24 hours of initial access. The group’s focus on newly disclosed flaws, web shells, RMM tools, and fast lateral movement makes patch speed, exposure management, and post-compromise detection critical for defenders.

Security

Device Code Phishing: AI-Driven Campaign Escalates

Microsoft Defender Security Research detailed a large-scale phishing campaign that abuses the OAuth device code flow using AI-generated lures, dynamic code generation, and automated backend infrastructure. The campaign raises the risk for organizations because it improves attacker success rates, bypasses traditional detection patterns, and enables token theft, inbox rule persistence, and Microsoft Graph reconnaissance.

Security

AI Cyberattacks Accelerate Threats Across Attack Chain

Microsoft warns that threat actors are now embedding AI across the full cyberattack lifecycle, from reconnaissance and phishing to malware development and post-compromise operations. For defenders, this means faster, more precise attacks, higher phishing success rates, and a growing need to strengthen identity, MFA protections, and visibility into AI-driven attack surfaces.

Security

PHP Webshells on Linux: Cookie-Controlled Evasion

Microsoft warns that threat actors are using HTTP cookies to control PHP webshells on Linux hosting environments, helping malicious code stay dormant unless specific cookie values are present. The technique reduces visibility in routine logs, supports persistence through cron jobs, and highlights the need for stronger monitoring, web protection, and endpoint detection on hosted Linux workloads.