Abstract
We expose a new security leak for smartphone users, which allows to stole user personal data by accessing the mobile operator user page when auto-login is employed. We show how any "apparently" genuine app can steal these data from some mobile operators, affecting more than 80% of Italian mobile smartphones.