A New Attack Lets Hackers Steal 2-Factor Authentication Codes From Android Phones

The malicious app required to make a Pixnapping attack work requires no permissions.