Envoy 2.3.7: screenshot protection on the seed QR screen and a new onion address for Passport Prime verification
Foundation has released Envoy 2.3.7, continuing the preventive security work started in 2.3.6. The Passport Prime security check has moved to a new onion address and gained an additional layer of verification; behavior where screenshot protection did not persist when switching from seed words back to the seed QR screen has been fixed. The vendor recommends that all users update.
Envoy users: update to 2.3.7 through the download page or app store; the vendor warns that App Store and Google Play review may cause a substantial delay before the update appears. On Android, you can optionally verify the binaries using the vendor's guide (links in the post). If the seed QR screen on a vulnerable version may have appeared in a screenshot or screen recording, treat the seed as compromised: create a new wallet in a trusted environment, write down and verify the backup, transfer funds and wait for confirmation, then retire the old wallet.
Sources: