A malicious app is a mobile application designed or modified to steal data, credentials, or money, or to enable other harmful activity. It may look legitimate while requesting excessive permissions, collecting sensitive information, or delivering unwanted advertising and malware.
What a malicious app is really doing
A malicious app is dangerous because it turns a familiar mobile interface into a delivery mechanism for theft, surveillance, fraud, or further compromise. The harm often comes from what the app does after installation, not just what it looks like in the store or on the device.
That distinction matters: a malicious app may behave like a normal utility, game, or productivity tool while quietly collecting data, intercepting authentication flows, or abusing device privileges in the background.
How malicious apps gain trust
These apps often rely on social engineering, weak app review signals, or deceptive branding to get installed. They may imitate legitimate services, use misleading descriptions, or request permissions that seem routine but are unnecessary for the app’s stated purpose.
Once installed, a malicious app can exploit the trust users place in mobile software, especially when it asks for access to contacts, messages, accessibility features, notifications, or other sensitive device functions. That trust boundary is part of what makes mobile malware so effective.
What malicious apps steal or abuse
The most common goals are credential theft, financial theft, data harvesting, and persistent access. In practice, that can include capturing passwords, one-time codes, session tokens, or personal data, then sending it to an attacker-controlled service.
Some malicious apps are built to support a wider intrusion chain. They may enable phishing, deliver additional malware, act as a foothold for remote control, or support account takeover by abusing sign-in prompts and device permissions.
Why mobile apps are a useful attack path
Mobile platforms combine personal data, authentication use, and constant connectivity, which makes a compromised app especially valuable to attackers. A single installation can expose messages, email, MFA prompts, cloud sessions, or payment details if the app is designed to harvest them.
For defenders, the practical issue is that the app can remain active after installation and continue collecting data or enabling abuse until it is removed, permissions are revoked, and any impacted accounts are reviewed.
Risk and Threat Considerations
Malicious apps are risky because they collapse the boundary between legitimate software use and attacker-controlled behaviour. The same installation that appears harmless can become a persistent channel for credential capture, data exfiltration, fraud, or downstream compromise of linked accounts and services.
Failure mechanism: The app abuses user trust, excessive permissions, or deceptive distribution to gain device access, then uses that access to collect secrets, intercept sessions, or trigger follow-on malicious activity.
Impact: Organisations and users can face account takeover, financial loss, data exposure, and a longer compromise window if the app remains installed or if stolen credentials and sessions are not revoked quickly.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1406 — Malicious App Store | Covers mobile app distribution abuse and deceptive installation paths. |
| T1629 — Hide Artifacts | Malicious apps commonly conceal activity to delay detection on devices. | |
| Recommendation — Monitor mobile app acquisition paths and investigate app-store abuse or deceptive installation campaigns. Hunt for concealed app behaviour and verify whether suspicious apps are masking persistence or activity. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Supports identifying risky mobile software and unapproved app exposure. |
| Recommendation — Inventory mobile software and remove or restrict apps that present unmanaged exposure. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-Rest is Protected | Malicious apps threaten data confidentiality by collecting and exfiltrating stored information. |
| Recommendation — Protect stored mobile data so a malicious app cannot easily harvest sensitive content. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Malicious apps often depend on excessive app permissions to cause harm. |
| Recommendation — Limit app permissions to the minimum needed for the device and use case. | ||
Practitioner Guidance
Why practitioners should care: Malicious apps are not only a user-awareness issue, they are an access-control and exposure problem. Review app permissions, installation sources, and observed behaviour as part of mobile risk management, especially where mobile devices access email, cloud apps, or business systems.
What to watch for: Be alert to overbroad permissions, unexpected accessibility requests, repeated consent prompts, strange battery or network use, and any app that requests authentication material or device-level control without a clear business need.
Practitioner takeaway: Treat suspicious mobile apps as a compromise risk until proven otherwise, and assume any credentials or sessions used through the device may need review if a malicious app was installed.
Related resources from NHI Mgmt Group
- Who is accountable when a malicious connected app is authorised by an employee?
- Who is accountable when a malicious OAuth app keeps reading mail after a password reset?
- Why do mobile permissions become a governance problem once a malicious app is installed?
- What fails when a malicious npm package reaches a mobile app build pipeline?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org