Threat video1:00
CVE-2026-65993 OsmAnd, Wikipedia Flaws: Detection & IOCs
GitHub's AI taskflows found an exported OsmAnd activity and a Wikipedia deeplink bypass. Hunt with 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for GitHub Security Lab Taskflow Agent identifies 24 Android app… →
Chapters
- 0:00The hookAn AI audit found 24 Android flaws.
- 0:04The storyTwo detailed cases: OsmAnd and Wikipedia.
- 0:12Attack pathThe AI audit found OsmAnd's exported activity.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise7 indicators to hunt: 1 domain, 2 URLs and 3 file names, and more.
- 0:39MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to impact.
- 0:43Remediation3 steps now: Update OsmAnd and the Wikipedia Android app to the latest.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00An AI audit found 24 Android flaws.
0:05Two detailed cases: OsmAnd and Wikipedia.
0:08Wikipedia's flaw enabled account takeover.
0:12The AI audit found OsmAnd's exported activity.
0:16Any installed app could track location.
0:18Look-alike hosts passed a loose check.
0:21One tapped link was all it took.
0:23Sessions work across Wikimedia projects.
0:28No threat actor is attributed. Confidence: low.
0:327 indicators to hunt: 1 domain, 2 URLs and 3 file names, and more.
0:397 ATT&CK techniques, from initial access to impact.
0:443 steps now: Update OsmAnd and the Wikipedia Android app to the latest.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.