Request pricing
Request pricing

Advanced malware protection and security

Connect with an expertMalware security research

Stay ahead of attackers

MOBILE MALWARE

Evolving malware bypasses basic OS protections

Modern malware continuously evolves, finding new ways to exploit the Android OS to target sensitive applications on user devices.
Common strategies include:

  • Accessibility (a11y) services abuse for automated fraud.
  • Overlays/UI injections to steal credentials.
  • Screen recording and keylogging.
01_MALWARE-PROTECTION-L_GRID-EVOLVING-THREATS-01
02_MALWARE-PROTECTION-R_GRID-SECURE-01
MULTI-LAYERED PROTECTION

Securing sensitive transactions from malware-assisted fraud

Mobile applications for banking, P2P payments, crypto, and digital wallets are high-value targets for malware. To stop these attacks, developers need a modern defense strategy that actively prevents malware from hooking into the application environment.

SECURITY-TESTING-ICON-300
Secure coding

Continuous, purpose-built mobile app testing based on OWASP MAS open standards.

OBFUSCATION-ICON-300
Multilayered protection

Multiple layers of static and dynamic protections that harden mobile code and actively prevent reverse engineering and tampering attacks.

PREVENT-FRAUD-ICON-300
Situational awareness

Real-time threat monitoring provides important forensics and insights while app attestation protects mobile APIs and backend services from abuse.

Stop malware-assisted fraud attacks before they start

Connect with a Guardsquare expert

Mitigating malware exposure

A reliable framework for continuous mobile app testing

With increasing time-to-market pressure, developers need to find and fix potential security issues (like hardcoded credentials) as they build code. They also need to ensure that their testing tools are designed for the unique risks of mobile apps.

The Guardsquare platform includes AppSweep mobile application security testing (MAST) that seamlessly integrates with today’s CI pipelines. Continuous, contextual remediation throughout the development cycle saves time and money while eliminating downstream opportunities for malware exploitation.

Alignment with OWASP Mobile Application Security (MAS) project testing guidelines and verification standards ensures a solution that is purpose-built for mobile.

Learn more about AppSweep

Block evolving techniques for app spying, overlay attacks, and accessibility abuse

The end goal of many phishing campaigns is widespread delivery of malicious code. Modern malware will often combine several different attack tools to find and exploit weaknesses in mobile app or device defenses. These may include:

  • A11y abuse
  • UI injections
  • Screen recording
  • Task hijacking
  • Clipboard and SMS spying
  • Malicious keyboards
  • Pixnapping
  • NFC fraud
  • App repackaging

DexGuard (Android) provides multi-layered protection against sophisticated malware, RASP checks provide dynamic defenses that specifically detect and block accessibility (a11y) abuse, UI injections, and screen recording without breaking legitimate app functionality. These protections also prevent app repackaging which is often used to disable malware defenses.

Learn more about DexGuard

Real-time threat monitoring and mobile API security

ThreatCast threat monitoring helps you stay ahead of evolving attacks through analytics that identify users or devices at risk of malware based attacks in real-time. Proactive monitoring is essential for understanding the reverse engineering steps performed by attackers, as well as the exploitation of victims and the required actions for containment.

Mobile API security is another key consideration. Server-side validation offered by Guardsquare’s mobile app attestation capabilities can verify that the application communicating with your backend APIs is genuine and unmodified.

Policy-based responses allow teams to dynamically adjust security controls on the server-side, without needing to re-release your app.

Learn more about ThreatCast
testing-homepage-carousel-copy
guided-workflow-homepage-carousel
Attestation-UI-8

Protection against modern malware

The Guardsquare platform combines industry-leading security solutions for continuous testing, multi-layered protections, real-time threat monitoring, and dedicated mobile API security.

DexGuard product image

DexGuard

ANDROID PROTECTION

Uncompromising protection for Android mobile apps and SDKs

Secure native Android and cross-platform apps and SDKs with DexGuard, offering multilayered, polymorphic obfuscation and built-in runtime application self-protection (RASP).

Learn more about Dexguard
AppSweep ANDROID & iOS

Find & address security issues in mobile apps and SDKs with AppSweep, our app security testing product. Designed for developers, ready for enterprise needs.

Learn more about AppSweep
Threatcast THREAT MONITORING

Monitor threats to mobile apps & SDKs in real time, adapt security configurations & identify security gaps & vulnerabilities post-publication.

Learn more about Threatcast

Explore malware protection resources

Blogs research & analysis

Real Examples of How Bad Actors Weaponize Mobile OS to Hack Your App

Learn how threat actors weaponize biometrics, GPS, and NFC features to commit fraud, and why client-side and server-side defenses are vital for AppSec.

Read the blog
Blogs best practices

Protect Against Evolving Malware Attacks with Threat Monitoring

Discover how mobile app threat monitoring helps detect malware campaigns early, including new and evolving threats, to keep your mobile app secure.

Read the blog
View All Resources

Malware Protection TL;DR

Malware on mobile phones poses the biggest risk to the device end users. Though detection and mitigation often falls in the technical purview of the platforms themselves (Android), specific mobile malware may take advantage of the knowledge gained during a reverse engineering effort to explicitly target and exploit apps on a user’s phone.

There is no single answer to protecting your app and your users data from malware, but having an in-depth defense strategy is the most effective way to prevent or limit the impact of malware on your application.

A dropper application is a common method used to install Android malware on mobile devices. (Other methods include phishing links and sideloading from third-party sources.)

Threat actors frequently disguise dropper apps on the Google Play Store as genuine apps (e.g., calculators, QR code scanners). When a user downloads and opens a dropper app, malware is secretly unpacked and loaded onto the device.

From there, the malware may exhibit other behaviors – such as downloading additional attack modules from a command and control (C&C) server, or trying to gain administrator privileges.

Malware may combine a variety of malicious techniques to exploit mobile applications. Some common examples include:

Accessibility (a11y) services are native features on the Android OS that assist users with disabilities. Malware can trick users into granting a11y privileges, which can then be used to interfere with a mobile app’s UI – such as keylogging sensitive account information.

Screen recording is a similar malware technique for stealing sensitive data. Screen-captured content (e.g., login credentials) is streamed to a C&C server by administrator commands from the admin panel.

UI injections typically happen in one of two ways to capture sensitive information or mislead the user. An unauthorized activity injection can be inserted above the legitimate app (e.g., a layer that mimics a login screen). Alternatively, an overlay injection inserts additional views or UI elements into the app.

Clipboard spying is when malware harvests and exfiltrates sensitive data that the device user copies to clipboard to paste later.

There are two key defensive considerations against mobile malware:

  1. Making data very hard to exfiltrate.
  2. Making any successfully stolen data very hard to reuse.

Making data hard to exfiltrate requires mobile app protections like runtime application self protection (RASP), which injects different security checks in the code, as well as real-time threat monitoring capabilities to detect malicious activities.

Making stolen data hard to reuse requires protections like device binding to counter manual reuse of stolen data. This means that the legitimate user’s application must be used on their specific mobile device in order to validate account access and any subsequent transactions. Device binding provides a safeguard against an attacker reusing credentials to login on a different device.

However, a bot with stolen credentials can automatically bypass client-side app protections by directly interacting with a mobile API. App attestation capabilities use token exchanges to ensure that only genuine mobile apps can call server APIs while blocking bots, scripts, agents, and non-genuine apps.

Guardsquare provides both the security expertise and customizable protection tools required to harden Android applications against malware attacks. Using DexGuard’s built-in malware protection feature, you can easily protect against accessibility services abuse, screen spying, and UI injection attacks while maintaining the full functionality and proper usability of your app for all users. By combining DexGuard’s malware protection with code hardening and runtime protection you can ensure the most robust protection.

You can learn more about malware, the common attack methods and behavior, and how to protect your app in our malware research at the Mobile Application Security Research Center.