Hackers can steal 2FA codes and private messages from Android phones - Ars Technica

Malicious app required to make “Pixnapping” attack work requires no permissions.