These vulnerabilities are extremely dangerous because they do not require any action from the victim, the security firm noted. Unlike with spear-phishing, attackers do not require victims to open a bogus PDF file or link – the fraudster can trigger the vulnerability and remove any trace of compromise without the victim's knowledge.

Android and derivative devices running on version 2.2 and later versions are vulnerable to these attacks. Devices that run Android versions older than Jelly Bean (which comprises roughly 11% of devices) are at the highest risk due to inadequate exploit mitigations.

Zimperium not only reported the vulnerability to Google teams, it also submitted patches. The company noted, “Considering severity of the problem, Google acted promptly and applied the patches to internal code branches within 48 hours, but unfortunately that's only the beginning of what will be a very lengthy process of update deployment.”

“It's good that Zimperium found these quite severe vulnerabilities, but it's not good they are going to be published at Black Hat,” Stu Sjouwerman, founder/CEO of the Clearwater, Fla.-based security awareness training provider Knowbe4, said. “That allows the bad guys to reverse engineer these vulnerabilities and infect the Android phones of all the customers of phone carriers that are slow with updates, or provide no updates at all, which happens more often than you think. Having your smartphone owned while logging into your bank account is a recipe for disaster.”

Sjouwerman said he strongly recommends using two-factor authentication for any financial transaction over the Internet, especially over any kind of wireless device.

Malware increasingly threatens mobile phone users. A May Symantec security report revealed that 17% of Android apps (nearly one million total) are actually malware in disguise. Most identified mobile malware tries to steal users' personal data, the security firm said. One third, or 2.3 million of 6.3 million Android apps, are grayware or malware apps. While these applications do not harm a smartphone, they are mainly intrusive because they track user behavior for the primary purpose of placing advertisements, Internet security expert Ali Raza said in a LIFARS newsletter.