49
Hackers can steal 2FA codes and private messages from Android phones
(arstechnica.com)
This is a most excellent place for technology news and articles.
...and there you go:
https://ccs25files.zoolab.org/main/ccsfb/1REOCPAR/3719027.3765061.pdf
https://misc0110.net/files/exfilstate_ccs25.pdf
From https://www.sigsac.org/ccs/CCS2025/accepted-papers/ (#378)
Literally published less than a day ago:
At the same conference (CCS) that the paper referred to by the ars technica article was accepted.