Polymorphism: Why the Shape of Mobile App Protection Must Change

According to credit reporting agency Equifax, “...mobile app security is often neglected by developers — making apps more vulnerable to fraud.” The reason for this is quite simple for most organizations: development speed is the dominant priority. In fact, 79% of mobile developers cite time-to-market pressure as the top barrier to stronger protection.

New coding tools featuring generative AI (GenAI), agentic AI, and large language models (LLMs) are helping developers keep up with rising demand. But this pipeline acceleration has been outpacing built-in AI guardrails, security policies, and industry regulations. If mobile app security slows down development, causes a drag on app performance, or negatively impacts user experience, it tends to get bypassed. The vast majority (95%) of CISOs report feeling pressure to suppress or delay compliance-related security issues when business deadlines are at stake, and 75% said that their organization had knowingly deployed vulnerable code into a production environment.

Compounding these problems, many of the same AI-enabled tools that help developers are simultaneously enabling bad actors to evolve and accelerate their attacks. But the ultimate danger of AI and LLM misuse is that one successful reverse engineering attempt could then be widely repurposed across similarly under-protected mobile applications. A single crack that launches a thousand attacks.

This is why a polymorphic security model (unique protections that change with each application build) is the best way to structurally deny that kind of automated scalability.

Fast, cheap, and out of control

Once developers release a mobile app into the wild, it’s largely out of their control. It can be installed on untrusted devices by users who may not have the best intentions. AI- and LLM-based tools can lower the bar for “baby hackers” or help experienced attackers amplify, iterate, and automate more sophisticated campaigns. According to Verizon’s 2026 Data Breach Investigations Report, “15 different attack techniques are now being bolstered by generative AI. Threat actors are using AI to work faster at every stage—from spotting security gaps to writing malware.” With respect to mobile applications, these assisted attacks include:

Theft of hardcoded secrets: An estimated 2.86 billion credentials were stolen in 2025. This year, AI is expanding the ways for secrets to get into the hands of bad actors. Security researchers were able to hijack three popular AI agents that integrate with GitHub Actions (Anthropic's Claude Code Security Review, Google's Gemini CLI Action, and Microsoft's GitHub Copilot) via a novel prompt injection attack to steal API keys and access tokens. Even more recently, researchers from Wake Forest University discovered hundreds of AI-powered iOS apps that exposed exploitable credentials or backend access mechanisms

Phishing at scale: LLMs can automate the entire phishing process, which cuts the cost of attacks by more than 95% and produces success rates equal to or greater than manually crafted campaigns. Investigators from INTERPOL estimate that AI-enabled fraud attacks are about 4.5 times more profitable than those without AI. Deloitte projects that AI-enabled fraud losses in the United States could reach $40 billion by 2027.

Synthetic identity fraud: According to IBM’s 2026 Cost of a Data Breach report, AI deepfake impersonation accounted for 45% of AI-driven attacks. AI helps threat actors spoof “know your customer” (KYC) authentication controls – targeting organizations that rely on digital identity verification to secure access to systems and high-value transactions. For example, research shows that AI-enabled injection attacks targeting iOS surged by 1,151% in the second half of 2025.

Designer malware: In August 2025, Anthropic disclosed real-world examples of attempted Claude misuse, including AI-generated malware. Recent mobile malware variants like NGate show telltale signs of GenAI assistance in their code. Samples of SURXRAT Android trojan conditionally download an LLM module to expand its capabilities. Canis C2 shows evidence of being built with the assistance of AI/LLM technologies, and researchers have described how PromptSpy incorporates Google’s tool “Gemini” for context-aware UI manipulation.

Mobile API abuse: Mobile APIs connect client-side mobile apps to backend/server-side resources, and 82% of mobile app publishers say API abuse is increasing. These attacks typically happen via non-genuine apps (those that have been reverse engineered and modified) as well malicious bots (44% of advanced bot activity now specifically targets APIs). Because mobile APIs often contain valuable data, they’ve also become a popular scraping target for AI agents.

Rogue agents: While much has been made of Mythos’ ability to locate deep code vulnerabilities, less attention has been paid to Anthropic’s early disclosure that Mythos also sometimes takes its agency a step further by exploiting discovered weaknesses without any prompting. This isn’t an isolated phenomenon. An independent mobile security researcher also described how giving a different AI agent root access to an Android phone plus a runtime hooking framework led directly to the agent autonomously reverse-engineering a mobile game app and then tampering it with a cheat modification. A similar case of “agent goes rogue during a simple exercise” was the widely publicized breach of Hugging Face by OpenAI in July 2026.

The good news is that these technologies don’t invent anything all that new. Misused AI- and LLM-enabled tools can help human attackers aggregate and automate existing malicious functions, but they’re not independent creative forces on their own. Setting aside science fictional “rise of the machines” fears, the impacts of these attacks will overwhelmingly be felt by orgs that are getting by with incomplete or outdated approaches to mobile app security (e.g., OS-only protections, DIY vibe-coded security, single-layer “wrapper” or hybrid solutions).

What defines modern mobile app protection?

Mobile apps and SDKs that perform sensitive functions (e.g., financial transactions, managing a medical device, digital identity authentication) should not rely on a single defensive mechanism. If every protected application or release looks the same, attackers can analyze one instance and apply that knowledge across any and all applications using the same kind of protection. This makes a single successful reverse engineering attack widely scalable, which is the worst-case scenario.

Mobile app developers can prevent this kind of attack scalability through modern protection that not only combines multiple defensive layers (code transformation, data encryption, control-flow changes, runtime checks) but that also changes its protective shape across builds, applications, and releases.

Polymorphism is an essential force multiplier

The goal of polymorphic protection is to prevent attackers from relying on a single, reusable playbook. With each new mobile app build or release, the attacker should face a significantly different set of security obstacles. A diverse and polymorphic approach can continuously “reset the clock” on their reverse engineering attempts. As AI- and LLM-adjacent tools help augment common forms of attack, polymorphism becomes a defining aspect of modern mobile application protection.

Polymorphism is effective against both static and dynamic attack attempts. In static attacks where malicious actors attempt to decipher the app's code through decompilation tools, a polymorphic approach will continuously alter code hardening techniques like obfuscation and encryption with each app build. This renders the malicious actors' efforts unrealistically expensive as they must repeatedly adapt to new configurations, hindering their ability to understand the application's structure and behavior over time.

As a counter to dynamic attacks like debugger attachment or hooking, a polymorphic protection solution can automatically inject RASP checks into random code locations; the unique placement of checks also changes with each build. This variability makes it exceedingly difficult for attackers to locate and evade detection.

Polymorphism is made possible through compiler-based mobile app security tools. A compiler-based security approach provides the ability to generate unique security controls with each application build. These deeply integrated protections are automatically randomized in terms of semantics, locations, and structure.

How Guardsquare can help

Guardsquare supports these core principles with purpose-built mobile application security that covers all parts of the software development lifecycle (SDLC). This starts with mobile application security testing (MAST) that continuously scans for security issues, like hardcoded secrets and other exploitable vulnerabilities, throughout the design and development phases.

In production, polymorphic layers of code hardening (obfuscation and encryption) and distributed RASP checks (which detect malicious behaviors at runtime) provide best-in-class protection against reverse engineering and tampering attacks. Guardsquare’s platform also includes mobile API security (in the form of app attestation) to ensure server-side trust, as well as real-time threat monitoring to help spot suspicious behaviors and expose broader threat campaign patterns.

Contact a Guardsquare expert today to learn more.