Attackers use NotCompatible as Android malware that turns infected devices into proxies for further abuse and network access. It can hide traffic, relay malicious requests and support credential theft or botnet activity. Defenders should look for unexpected outbound connections, proxy-like behaviour on mobile devices and apps that request network-related permissions without a clear need.
How NotCompatible turns an infected Android device into part of the attack path
NotCompatible is used as a mobile foothold that converts a compromised phone or tablet into an intermediary in the attacker’s infrastructure. That changes the device from a victim endpoint into a relay point, which helps attackers blend traffic into normal mobile behaviour and use the device as a reusable access path for other malicious activity.
The practical security point is that proxy-style malware is not only about the local device. It extends the abuse to whatever traffic, credentials or internal services the device can reach, so defenders should think about both device compromise and downstream network abuse.
What attackers gain from proxying traffic through mobile malware
When attackers use NotCompatible as a proxy, they are trying to hide the true source of their activity behind a seemingly ordinary mobile endpoint. That makes abuse harder to attribute, helps malicious requests inherit the reputation of a residential or mobile network, and can create a stepping stone into services that trust device-originated traffic more than anonymous internet traffic.
This pattern also helps with scale. A single infected device can be used for repeated requests, short bursts of credential attacks, or as one node in a larger botnet-style relay network. The malware does not need to be noisy to be useful, because the value comes from access, obfuscation and persistence rather than obvious payload delivery.
For defenders, the telltale issue is not just malware presence, but abnormal network role. A phone that suddenly behaves like infrastructure, especially one making sustained outbound connections, relaying requests or talking to unusual destinations, should be treated as a compromise indicator rather than a user convenience issue.
Why credential theft and botnet behaviour matter in the same campaign
NotCompatible can support credential theft alongside relay behaviour, which makes it more than a simple proxy tool. Once credentials are captured, the attacker can reuse them from the proxied device path or from elsewhere, turning a mobile compromise into broader account abuse, fraud or lateral access to other systems.
That combination is dangerous because it couples transport concealment with identity abuse. The malware can help attackers collect secrets, then use the same infected device to route follow-on actions in a way that is less likely to trigger geolocation, reputation or network-based controls.
When a mobile device participates in botnet activity, the defender has to assume the attack surface may extend beyond the device itself. Even if the handset is cleaned later, any credentials, sessions or trust relationships exposed during the compromise may still need review and revocation.
Risk and Threat Considerations
Proxy malware on mobile devices is risky because it can bypass simple perimeter logic. If an attacker can route abuse through a device that appears legitimate, they may evade reputation filters, confuse attribution and use the device to reach services that treat mobile-originated traffic as lower risk.
Failure mechanism: The malware establishes a covert relay or proxy channel, then uses that channel to forward malicious requests, conceal source traffic and support credential theft or botnet operations from an otherwise ordinary mobile endpoint.
Impact: Organisations can see account abuse, hidden access paths and misleading traffic origin, which increases the chance of missed detection, expanded compromise and repeated misuse of stolen credentials or sessions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1090 — Proxy | NotCompatible’s relay behaviour maps directly to proxying malicious traffic. |
| T1021 — Remote Services | The malware uses the device as an access path for further abuse and network reach. | |
| Recommendation — Detect and disrupt proxy use that hides the source of malicious network traffic. Hunt for abnormal remote access paths that originate from compromised mobile devices. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Proxy-like mobile traffic and unusual outbound connections require network visibility and alerting. |
| Recommendation — Monitor outbound traffic patterns for proxy behaviour and suspicious mobile endpoints. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | Detecting misuse depends on log signals from devices, apps and authentication activity. |
| Recommendation — Correlate device, app and authentication logs to flag relayed or abnormal mobile traffic. | ||
Practitioner Guidance
What to verify: Check for persistent outbound connections from mobile devices, unexpected proxy behaviour, and apps that ask for network-related permissions without a clear business need. Correlate device telemetry with authentication logs to see whether suspicious mobile traffic lines up with account activity.
Decision rule: If the device is acting like a relay or showing signs of credential abuse, treat it as a compromise response case, not just a mobile app removal task. Revoke any exposed sessions or tokens and review whether the affected accounts were used from unusual network paths.
Practitioner takeaway: The key judgement is to treat NotCompatible as an access-enablement problem as much as a malware problem, because the attacker value comes from the device’s ability to hide and forward abuse, not only from what runs locally on the handset.