Haseeb Awan - efani.com

⚠️ WARNING: Answering a Telegram call could give an attacker a route to full control of an unpatched #Android phone. NebuSec reports a Telegram flaw that, chained with an information leak and an Android root exploit, could expose messages, the microphone and camera. The attacker needed an ordinary Telegram account and the victim to answer a private voice call. Affected versions span 8.6.2–12.10.3, covering releases from March 2022 through September 2026. @telegram fixed the flaw in Android version 12.10.4. NebuSec confirmed the issue on ARM64 Android phones. It reported no observed exploitation in real attacks and no evidence directly implicating iOS, desktop or group calls. Check your installed version now. The number appears at the bottom of Telegram’s Settings page.

Your vibecoded app works today... One future update could break it! Our GM, Mark Kreitzman, warns about returning to modify an application after AI has lost important development context. If you don’t understand the architecture, you may miss what the change breaks. Watch Mark explain the risk to @perezcarreno on The Web Talk Show. Full conversation in the next post. 👇

🔒 The encrypted data can remain on your phone - even after the key needed to read it is destroyed. That is the mechanism Deniable founder Josh Thomas explains in this clip with @efani’s Mark Kreitzman. According to Josh, Deniable’s duress PIN destroys the encrypted, or “wrapped,” master key protecting the hidden volume. The stored data remains ciphertext, but the key needed to decrypt it can no longer be recovered through that mechanism. This is cryptographic erasure: making encrypted information inaccessible by destroying the key rather than overwriting every file. Josh also explains how Deniable is designed to leave the public phone environment accessible afterward. Watch Josh explain what is destroyed, what remains and why it matters. Full interview in the next post. 👇

‼️ Hackers are using FAKE Meta job interviews to steal Facebook and Google accounts, even when 2FA is enabled. Malwarebytes uncovered a phishing campaign using fake Calendly pages to book 30-minute recruiter calls. Victims choose a slot, enter personal details and complete a fake CAPTCHA. Then comes the trap: fake Facebook and Google logins that steal passwords and 2FA codes in real time. Your phone's security codes can become the attacker's way in. 🧵

⚠️ Your crypto security plan needs an answer to: “Unlock your phone. Now.” An attacker who threatens you directly may never need to crack a password. That is the danger behind a “wrench attack” - using physical coercion to force someone to surrender access to their assets. Your phone can reveal wallet apps, exchange accounts, private conversations and clues about what you own. For high-value targets, that exposure deserves serious attention. In this clip, Efani’s Mark Kreitzman and Deniable founder Josh Thomas discuss the “decoy wallet” analogy: revealing a limited environment while keeping more sensitive information separate. Josh explains how that thinking informs Deniable’s approach to phone privacy. It cannot guarantee safety during an attack, but it raises a question every crypto holder should consider: How much would someone discover if they forced you to open your phone? At @efani, we see phone-number protection, account security and device privacy as connected parts of protecting your digital life. Watch the clip. Full interview and Deniable details in the next post. 👇

🚨 It's 2026. We have password generators, password managers, Face ID, and passkeys. Yet someone reportedly used "123456" to help expose 8.8 MILLION records in Denmark. 🤡 According to reports, THREE accounts at an IT contractor used this password. One was an ADMIN account. 8.8 million records. Protected by the password equivalent of leaving your front door wide open. You can't make this stuff up. 👇

50% of IT security spending could go toward preemptive cybersecurity by 2030. The warning: waiting for an attack alert may leave you reacting after the damage. That is Gartner’s forecast, discussed by @DRtheNerd of @adam_networks in this clip. David explains his approach to zero-trust connectivity: allow destinations that are known, trusted, and necessary, while restricting everything else. He also describes using AI to identify legitimate connections without disrupting everyday applications. For executives, founders, and crypto holders, that prevention mindset belongs in mobile security too. The phone number connected to your identity and account recovery deserves protection before someone attempts a takeover. At @efani, that is central to our work against SIM swap attacks. Watch David discuss the shift with our GM, Mark Kreitzman. Full interview in the next post. 👇

🚨 Crypto has a MASSIVE security problem, and billions of dollars in digital assets depend on getting it right. Ethereum, Solana, Cardano, and other blockchains operate on different architectures. The bridges connecting them can introduce serious security vulnerabilities. And when those systems fail, real money is at risk. But what if we could connect blockchain ecosystems without moving the underlying assets off their original chains? 🎙️ In Efani Features Ep. 35, Mark Kreitzman speaks with Ken DiCross (@KenDicross), Co-Founder & CEO of Wire Network (@WireNetwork), about: - Why crypto bridges are vulnerable attack surfaces. - How Wire Network aims to solve cross-chain interoperability. - Why AI agents could transform the future of DeFi. - How universal crypto wallets could change blockchain adoption. 🔐 At @efani, we believe securing your digital assets requires protecting every layer, including the mobile identity linked to your financial accounts. ▶️ Watch the full interview: Link below 👇🏼 #CryptoSecurity #Blockchain

⚠️ By the time a security alert identifies an attack, your private data could already be gone. @DRtheNerd of @adam_networks argues for a different starting point: block connections by default, then allow destinations that are known, trusted, and necessary. In this clip, he explains how that “default-deny” approach works - and uses the very platform recording this interview to show how legitimate applications can still connect. For mobile privacy, the question matters: what should your device be allowed to communicate with before anyone has identified a threat? At Efani, we share that emphasis on prevention. Our focus is protecting the phone number tied to your identity and account recovery before a SIM swap puts it in someone else’s hands. Watch David explain the approach to our GM, Mark Kreitzman. Full interview in the next post. 👇

🚨 Five minutes. An attacker’s server could be gone before your defenses catch up. In this clip, @DRtheNerd of @adam_networks describes how attackers can spin up cloud infrastructure, use it briefly, and tear it down - making security built around known malicious IP addresses a moving-target problem. His argument: protection needs to consider which destination a device is trying to reach and whether that connection should be allowed in the first place. Watch David explain his approach to our GM, Mark Kreitzman. Full interview in the next post. 👇

They suffered a ransomware attack - and they’re STILL running Windows XP-based industrial controllers. In this clip, @DRtheNerd of @adam_networks explains why replacing legacy manufacturing equipment can require an expensive hardware overhaul. The machines still do their jobs, so businesses keep them running. But “still working” does not mean secure. David also warns that industrial systems assumed to be offline can have connections for remote management and monitoring. His approach: restrict those systems to the connections they actually need and isolate them to limit the damage a compromised device can cause. For mobile privacy, the same question deserves attention: what have you trusted simply because it still works? At @efani, we believe that scrutiny should include the carrier protecting your phone number. Watch David explain the problem to our GM, Mark Kreitzman. Full interview in the next post. 👇

🚨 Your phone can stay in your pocket while your number moves to someone else’s control. Who is actually checking the transfer? In this clip, our GM, Mark Kreitzman, explains the carrier portals behind phone-number transfers - and how a few pieces of account information can let a provider pull a number over without a phone call between carriers. That makes the transfer process a critical part of your security. If your number supports account recovery or SMS verification, an unauthorized transfer can put much more than your mobile service at risk. At @efani, we approach that access differently. As Mark explains: “We unplug you from those portals.” Moving a number away from Efani requires our team’s involvement and human verification. For crypto holders, executives, and anyone facing targeted threats, who can move your number - and how they verify the request - should be a serious consideration when choosing a mobile provider. Watch Mark explain the difference to Danny Ravaz on @upnextboys. Full interview in the next post. 👇

⚠️ Your password can stay secret while someone else takes over your account. All they need is a recovery process that trusts the phone number they just stole. Our GM, Mark Kreitzman, describes how attackers controlled his number for 61 minutes. When he reached Wi-Fi, he discovered multiple password-reset alerts. Then came another nightmare: convincing his carrier that he was the victim. Speaking with Danny Ravaz on @upnextboys, Mark explains how attackers can work through email, banking, and crypto platforms using “Forgot password.” If a service lets them reset access with an SMS code, that code can arrive on the attacker’s device. For crypto holders, executives, and anyone with sensitive accounts, phone-number security belongs alongside strong passwords and stronger authentication. At Efani, protecting that number is central to what we do - because the consequences can follow you long after your service returns. Watch Mark’s account below. Full interview in the next post. 👇

A bodyguard can’t protect every part of your life. Your privacy, travel and emergency readiness need a plan too. Joe LaSorsa (@LaSorsaTraining) joins our GM, Mark Kreitzman, to explain what executive protection actually includes. Watch the clip. Full interview and our mobile security take below ↓