Mobile Malware Guide: Android Banking Trojans and Spyware

Mobile malware has moved from nuisance adware to banking trojans that read one-time codes and spyware that needs no click at all, and the phone is now where most people approve logins and payments. Banking trojans abuse accessibility services and overlays to steal credentials and drive the banking app, while commercial spyware such as Pegasus targets a few high-risk people through exploits. This guide covers delivery routes, the Android and iOS techniques that matter, the main families in MITRE ATT&CK for Mobile (v20), and controls, response and metrics, for endpoint, mobile and fraud teams. Device enrolment, app protection policies and BYOD design are covered in the Mobile Device Security Guide and are not repeated here.

Key takeaways

• Most commodity mobile malware is installed by the victim. Smishing links, sideloaded APKs and store apps that turn malicious after an update need no exploit, so installation controls matter as much as detection.
• Accessibility abuse is the core Android banking technique. Once granted, it lets malware read the screen, draw fake login overlays, inject taps and stop its own removal (ATT&CK T1453, T1417.002, T1516, T1629.001).
• SMS and notification codes are not a safe second factor on an infected phone. Families such as TrickMo exist to steal one-time codes, so high-value accounts need phishing-resistant authentication and server-side device risk checks.
• Zero-click spyware is rare but needs its own playbook. Apple Lockdown Mode, Android Advanced Protection, fast patching and forensic triage before any wipe matter for the few people likely to be targeted.
• Detection only helps when access depends on it. Mobile threat defence (MTD), Play Protect and Play Integrity verdicts should drive compliance and session decisions.

What makes mobile malware different

Mobile operating systems sandbox every app, so malware either persuades the user to grant powerful permissions or exploits the OS. That changes what defenders look for:

• Permissions are the payload: accessibility, notification access, SMS, device administrator and "display over other apps" rights give a banking trojan what it needs without any exploit.
• The user interface is the attack surface: small screens make fake prompts convincing. ATT&CK notes that the constrained display size of mobile devices "may impair the ability to provide users with contextual information" (T1417.002 GUI Input Capture).
• Android and iOS differ sharply: most commodity families in ATT&CK target Android, where installing from outside the store is a user setting. iOS entries rely on jailbroken devices, private API abuse, compromised developer tools, infected computers over USB or exploit chains.
• Store review is evaded: MITRE says T1407 Download New Code at Runtime is "primarily used to evade static analysis checks and pre-publication scans in official app stores"; T1661 covers benign apps turned malicious by an update.

ATT&CK for Mobile v20 has 12 tactics, from Initial Access (TA0027) through Defense Evasion (TA0030) and Credential Access (TA0031) to Impact (TA0034). The general taxonomy of loaders, RATs and stealers is in the Malware Guide.

How mobile malware arrives

NIST SP 800-124 Rev. 2 (section 3.1.9) names sideloading from "untrusted or unknown sources" under mobile malware and treats unknown third-party apps on enterprise-accessible devices as untrusted. The lure side is covered in the Phishing Guide.

Android banking trojans: overlays, accessibility and OTP theft

Banking trojans combine a small set of techniques. Removing the capability through OS settings beats chasing each new family.

FluBot shows the pattern end to end: The Register reported that it spread by texts about missed parcels and voicemails, used accessibility permissions to steal banking credentials, and texted a malicious link to every contact, until a Europol-led operation disrupted it in May 2022. Physical attacks (T1461 Lockscreen Bypass) need a stolen or seized device; passcode complexity, wipe after failed attempts and security updates mitigate them.

Mobile malware family reference

Descriptions summarise MITRE ATT&CK for Mobile v20 software entries; use the S-number to pull technique mappings into detection engineering.

Banking trojans and financial fraud

Spyware, RATs and stalkerware

Stalkerware is usually installed by someone close to the victim, so treat removal as a personal safety decision as well as a security one.

Commercial and state-linked spyware

Fraud, ransomware, rooting and droppers

Other families tracked

ATT&CK entries with little public description, listed for completeness: OldBoot (S0285), PJApps (S0291), OBAD (S0286), RuMMS (S0313), DressCode (S0300), BrainTest (S0293), NotCompatible (S0299), GPlayed (S0536), SpyDealer (S0324), RedDrop (S0326), RCSAndroid (S0295), Xbot (S0298), XLoader for iOS (S0490) and KeyMarble.

Prevention and detection controls

Hardening for people likely to be targeted

• Lockdown Mode: Apple designed it for "the very few individuals who, because of who they are or what they do, might be personally targeted" (iOS 16 and later). It blocks most Messages attachments and link previews, complex web technologies, wired connections while locked, configuration profiles and new MDM enrolment, so enrol devices first.
• Android Advanced Protection: keeps Play Protect on, blocks unknown sources, limits accessibility services to verified tools, adds USB protection and 2G blocking, and offers encrypted Intrusion Logging.
• Threat notifications: Apple alerts users it believes were targeted by mercenary spyware on the device, by email and at account.apple.com, and never asks them to click links or install profiles.

Where identity fits

Most mobile malware is a credential and session theft problem.

• Retire SMS and notification codes for high-value accounts: T1517 and T1636.004 exist because one-time codes arrive on the infected device, and SIM swap (T1451) captures them without malware. Move to passkeys or FIDO2 security keys. See the Authenticator Apps and OTP Guide.
• Treat app tokens as targets: Gooligan stole Google authentication tokens, and T1635 covers OAuth token theft through URI hijacking. Keep token lifetimes short and revoke on device risk. See the Token and Session Security Guide.
• Use device risk in the session: banking and workforce apps can call Play Integrity and refuse sensitive actions when appAccessRiskVerdict reports UNKNOWN_CAPTURING, UNKNOWN_CONTROLLING or UNKNOWN_OVERLAYS, or when playProtectVerdict is MEDIUM_RISK or HIGH_RISK. See the Device Trust and Posture Guide.
• Keep secrets out of apps: anyone can unpack an app, as the Mobile Apps Hard-Coded AWS Keys 2022 research showed; scan for secrets during vetting.

Responding to a suspected infection

1. Contain access first: mark the device noncompliant or set the MTD threat level to high so conditional access blocks it, then revoke refresh tokens and sessions for the user's work apps.
2. Reset credentials from a clean device: passwords, MFA registrations and recovery numbers; for banking trojans, the user should call their bank on a known number.
3. Preserve before removing: for suspected spyware, do not reset first. Amnesty International's Mobile Verification Toolkit (MVT) supports "consensual forensic analysis of Android and iOS devices"; Advanced Protection Intrusion Logging adds evidence.
4. Remove: apps that block uninstall (T1629.001) may need device administrator rights revoked first; wipe and re-enrol corporate devices, and wipe the work profile on BYOD.
5. Hunt across the fleet: search MDM app inventory for the package name and signing certificate, and sign-in logs for new device registrations.
6. Escalate targeted cases: for an Apple threat notification, enable Lockdown Mode and get expert help; Apple points users to Access Now's Digital Security Helpline.

Rolling out mobile malware defences

1. Inventory: list device populations by management model and which apps hold accessibility, notification and SMS permissions today.
2. Pilot in report mode: run MTD and Play Integrity checks report-only on a pilot ring for two to four weeks and count would-be failures.
3. Close installation paths: disallow unknown sources and USB debugging on managed devices, publish the app catalogue, and add the accessibility allow-list, including assistive apps users need.
4. Enforce: tie MTD threat level and attestation to compliance and conditional access, one app at a time, starting with email.
5. Protect high-risk users: enable Lockdown Mode or Advanced Protection for executives, administrators and staff who travel to high-risk regions.
6. Roll back safely: return enforcement to report-only rather than deleting policies, and keep a break-glass group excluded from device risk rules.

Decision guidance: on corporate devices, block sideloading and rely on the app catalogue. On BYOD, where installs cannot be controlled, MTD, app protection and server-side Play Integrity checks are the realistic layer. Small organisations can start with Play Protect, OS currency rules and passkeys; large or regulated organisations, and banks with customer apps, should add MTD and in-app device risk checks. Reserve Lockdown Mode and Advanced Protection for named people, since both break some features.

Detection and measurement

Send MTD alerts, MDM inventory and compliance changes, and sign-ins with device state to the SIEM. Alert on new apps holding accessibility or notification listener rights, high MTD threat levels, Play Protect turned off (POSSIBLE_RISK), failed integrity verdicts, and MFA methods registered from a risky phone.

• Sideload exposure: percentage of managed devices with unknown sources allowed; target zero outside approved exceptions.
• Accessibility drift: number of devices with an accessibility service not on the allow-list.
• Time to contain: median minutes from high-severity MTD detection to blocked access and revoked tokens.
• Patch currency: percentage of devices with a security patch less than 90 days old.
• Phishable factor use: share of privileged and finance users still using SMS or notification codes.

Framework mapping

The NIAP Protection Profile for Mobile Device Fundamentals (v3.3) calls this threat T.MALICIOUS_APP. In NIST CSF 2.0, installation control sits under PR.PS-05 and monitoring under DE.CM-09.

Common failure patterns

• Trusting the store: approving an app once and never re-checking it, although T1661 and T1407 exist specifically to pass review and change later.
• SMS codes for high-risk staff: smishing remains the cheapest route to both malware and credentials; the Twilio Breach 2022 began with SMS phishing of employees.
• MTD that changes nothing: compliance and conditional access ignore the threat level, so an infected phone keeps syncing mail.
• Wiping before triage: a reset destroys the evidence that separates commodity malware from targeted spyware.
• Unchecked accessibility grants: nobody inventories which apps hold accessibility or notification access, the rights banking trojans depend on.

Practitioner checklist

• Disallow installs from unknown sources and USB debugging on every managed Android device.
• Vet catalogue apps using NIST SP 800-163 Rev. 1, including secret scanning of in-house apps.
• Set an accessibility service allow-list and notification listener restrictions through MDM.
• Connect MTD threat level and attestation results to compliance and conditional access.
• Check Play Integrity app access risk and Play Protect verdicts before sensitive in-app actions.
• Replace SMS and notification codes with passkeys or FIDO2 for privileged, finance and executive users.
• Enable Lockdown Mode or Advanced Protection for named high-risk people.
• Write a mobile incident playbook: contain, revoke tokens, preserve evidence, then remove.

Standards and references

• MITRE ATT&CK: Mobile Tactics
• NIST: SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise
• NIST: SP 800-163 Rev. 1, Vetting the Security of Mobile Applications
• Android Developers: Play Integrity API Integrity Verdicts
• Google: Use Google Play Protect to Help Keep Your Apps Safe
• Google: Advanced Protection for Android
• Apple: About Lockdown Mode
• Apple: About Apple Threat Notifications and Protecting Against Mercenary Spyware

Related NHI Mgmt Group resources: Mobile Device Security Guide · Malware Guide · Device Trust and Posture Guide · Authenticator Apps and OTP Guide · Phishing Guide