A new attack method called Pixnapping has been developed, allowing malicious applications to capture sensitive information like two-factor authentication (2FA) codes and location data in under 30 seconds without requiring system permissions. This attack has been successfully demonstrated on devices such as the Google Pixel and Samsung Galaxy S25, and it can adapt to other models. Despite Google's release of mitigations, modified versions of the attack remain effective. The malicious app prompts targeted applications to display sensitive information, which it can then capture by mapping graphical operations to screen coordinates. Information not displayed on the screen, such as secret keys within an app, is secure from this attack. Pixnapping is similar to a previous attack called GPU.zip, which exploited vulnerabilities in graphics processing units (GPUs) to extract sensitive visual data, and the weaknesses exploited by GPU.zip have not been fixed.