App-based trojans are malicious applications that appear legitimate while performing hidden harmful actions. They commonly steal credentials, capture input, abuse permissions, or download extra payloads after installation, which can let an attacker control the device or access data and accounts.
What app-based trojans do
App-based trojans are a deception problem as much as a malware problem: the app looks normal enough to get installed, then performs actions the user did not intend. The danger comes from that trust gap, because the malicious behaviour often begins only after the application has been granted permissions or accepted as legitimate.
That pattern is why trojans are often used as a first foothold. The visible app can hide credential theft, input capture, data access, or a secondary payload that extends the compromise beyond the initial installation.
How app-based trojans are delivered
These trojans commonly arrive through fake installers, trojanised copies of popular apps, repackaged downloads, malicious ads, or other social engineering paths that make the app appear safe. The attacker does not need to break the operating system first; they only need the user to install the wrong application.
Once installed, the malware may request permissions that seem plausible for the app’s claimed function. That makes the delivery stage important, because the installation decision often creates the trust and access the trojan later abuses.
For background on the broader malware family and common delivery routes, see Trojans Guide.
What attackers gain from an app-based trojan
The main value of an app-based trojan is access. A successful implant can steal usernames, passwords, session tokens, payment details, or other sensitive data, then use that access to enter accounts or move deeper into the environment.
Some trojans also capture keystrokes, overlay fake login screens, or abuse granted permissions to read messages, files, contacts, or accessibility data. Others function as loaders, downloading more tooling after installation so the initial app is only the opening stage of the compromise.
Because the malicious app is already on the device, the attacker may be able to blend in with ordinary app activity while silently extending control and persistence.
How defenders detect and respond
Defence is strongest when organisations combine endpoint telemetry, application control, and user awareness rather than relying on a single control. Trojans are often easiest to spot through unusual permission requests, suspicious network calls, unexpected child processes, or post-install behaviour that does not match the app’s declared purpose.
Validation exercises help here because defenders need to know whether their controls actually catch masquerading software, downloader behaviour, and trojan-style persistence. A practical way to test that coverage is to use Breach and Attack Simulation (BAS) Guide to map simulated abuse paths to detections and response playbooks.
When a trojan is suspected, the response should focus on removing the application, reviewing the device for follow-on payloads, and checking whether any credentials, sessions, or tokens used on that device may now be exposed.
Why app-based trojans are hard to stop completely
App stores, signed packages, and familiar user interfaces can reduce suspicion, but they do not guarantee safety. A malicious app can still present a valid-looking front while using legitimate-looking functionality as cover for harmful behaviour.
That is why browser-style trust assumptions and token storage lessons matter beyond the web. If a trojan can reach credentials or session material on the device, the compromise can move from a single app install to account takeover. For a useful comparison point on token theft and trust boundaries, see OAuth for Browser-Based Applications and the BFF Pattern Guide.
The practical takeaway is simple: app appearance is not a security signal. Defenders need behavioural inspection, permission scrutiny, and post-compromise review because the most damaging part of a trojan is usually the hidden action, not the installation event itself.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1204.002 — User Execution: Malicious File | App-based trojans rely on users installing or running deceptive software. |
| T1036.005 — Masquerading: Match Legitimate Name or Location | Trojan apps depend on appearing legitimate while hiding malicious behaviour. | |
| Recommendation — Map trojan delivery to user-execution paths and hunt for masquerading installers and follow-on activity. Detect masquerading apps by validating publisher, path, name and behavioural anomalies. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | Trojans are malware that require prevention, detection and response controls. |
| Recommendation — Deploy malware defenses to block, detect and contain trojanised applications. | ||
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | Trojan apps are malicious code that must be detected and contained on endpoints. |
| AC-6 — Least Privilege | Trojans abuse excessive app permissions and access to sensitive data. | |
| Recommendation — Apply malicious code protection to identify and block trojan payloads. Restrict app privileges so a trojan cannot reach more data or functions than necessary. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org