What is Mobile Malware?

Understanding Mobile Malware

The sophistication and variety of mobile malware have rapidly evolved, presenting significant threats to mobile users. These users are increasingly targeted through advanced social engineering tactics, which enable attackers to bypass comprehensive security systems on popular platforms like Android and iOS, unleashing a range of malicious software activities.

The continuously evolving landscape of mobile technology and the proliferation of mobile device use in personal and professional contexts further underscore the pressing need for heightened awareness and defense mechanisms against mobile malware threats.

Scope of Mobile Malware

Although mobile threats are less pervasive than traditional malware, cybercriminals are increasingly exploiting the mobile-first trend. For organizations, the explosion of bring-your-own-device (BYOD) and personal device use for work gives attackers fertile ground to launch mobile malware attacks.

Despite efforts to control personal device usage, their shadow use is pervasive. The lack of security on these mobile devices makes them a target for attackers seeking to gain access to networks and systems to steal assets or conduct additional attacks.

Due to the limited visibility into mobile devices and the multitude that lack anti-malware antivirus software, they are increasingly used to launch zero-day and other devastating attacks.

Additional reasons for the growth of mobile malware are:

• A growing volume of sensitive and high-value tasks are carried out on mobile devices.
• Mobile devices are often connected to insecure external networks, like public Wi-Fi.
• Threat actors can hide malicious software amongst legitimate apps in third-party app stores.
• Users are more likely to click malicious links in legitimate-looking email or text messages on mobile devices.

Historical Context and Evolution of Malware

Mobile devices have been targeted since the turn of the millennium. Purpose-built mobile malware was first seen in 2004. Since then, mobile malware has grown in use and sophistication. The following timeline provides a brief overview of its evolution.

How Is Mobile Malware Used?

The most common use of mobile malware is to steal sensitive information, such as usernames and passwords, bank account numbers, Social Security numbers, private messages, and location information.

Cybercriminals also use mobile malware to generate revenue through ad fraud (e.g., sending unwanted ads to generate fake ad clicks) and installing cryptomining tools to generate cryptocurrency.

Mobile malware is also used to compromise accounts and exploit vulnerabilities. Once installed, mobile malware can be spread to other devices in the initial target’s network. Mobile malware can also move laterally across networks to gain additional access privileges.

What Are Common Types of Mobile Malware?

Mobile malware comes in many of the same varieties as traditional malware but is optimized to exploit the differences in mobile environments. Early strains of mobile malware targeted legacy platforms, such as BlackBerry OS and Symbian OS. Today, most mobile malware targets iOS and Android devices. The following are several of the most widely seen types of mobile malware.

Cryptomining Malware

Attackers use cryptomining malware to generate cryptocurrency using compromised mobile devices' processing power. An example is the ADB.miner mobile malware, which targets Android devices for this purpose.

Drive-By Downloads

Traditional drive-by-download malware is used to target mobile devices. Some types of malware that can be pre-installed in drive-by downloads include trojans, ransomware, keyloggers, botnets, and data transfer tools.

MMS Malware

MMS malware spreads through text messages with text, photos, and videos. An example of MMS malware is FluBot, used in a large-scale smishing attack that targeted Android devices in Europe.

Mobile Bots

Mobile malware is used to create mobile botnets. Ikee.B was the first mobile malware bot software detected. SpamSoldier is an Android SMS botnet that sends spam messages to other victims without the user's permission.

Mobile Phishing

Mobile phishing attacks are sent via email or SMS text messages, often called SMiShing. Tactics used for mobile phishing include using Tiny URLs to disguise malicious sites and URL padding, which conceals a malicious domain by embedding it in a legitimate one.

Remote Access Tools (RATs)

RATs are used to access data on infected mobile devices. They are often used to access information on mobile devices, such as installed applications, call history, address books, web browsing history, and SMS data. RATs also send SMS messages, enable device cameras, and log GPS data.

Trojan Horses

Cybercriminals typically insert Trojans into non-malicious executable files or apps on compromised devices. Several types of Trojans used for mobile malware exploits include bank Trojans, SMS Trojans, and Wireless Application Protocol (WAP) clickers.

Mobile Malware Attack Real-World Scenarios and Consequences

The following are several examples of mobile malware attacks. These cases illustrate specific threats and demonstrate the impact of mobile malware.

Pegasus Spyware

WhatsApp was attacked with Pegasus spyware that exploited a vulnerability in its platform. This Pegasus attack led to the compromised mobile phones of individuals, including business executives and journalists. The malware allowed attackers to intercept encrypted communications and steal sensitive data.

XcodeGhost

In this third-party supply chain attack, several popular apps, including WeChat, were infected when developers unknowingly used a compromised version of Apple’s Xcode to build their software. Organizations using these apps were affected as malicious backdoors exposed their data to attackers.

GriftHorse Trojan

The GriftHorse malware was hidden in apps downloaded from the Google Play Store. When users installed these apps, they enrolled in fraudulent premium SMS services, which led to fraudulent charges.

FluBot Trojan

The FluBot Trojan was spread through Smishing attacks. This mobile malware stole passwords and banking information from Android devices.

Mobile Malware Detection and Prevention Strategies

Many tools and techniques are used to detect and prevent mobile malware from infecting devices. The following are several of the most commonly used tactics supported by cybersecurity tools:

• Intrusion Detection Systems (IDS)
• Intrusion Prevention Systems (IDS)
• Anti-Malware Tools
• User and Entity Behavior Analytics (UEBA)

Signature Detection

Signature detection identifies mobile malware by looking for unique features of different variants, such as the file hash, the domains, the IP addresses it contacts, and strings within an executable. While signature detection is effective, it cannot identify zero-day threats and evolving malware variants.

Anomaly Detection

Artificial intelligence (AI) is used to power many anomaly detection tools. These systems start with a model of regular operation and continuously scan for deviations from that model. Anomaly detection is an effective method for identifying novel mobile malware threats.

Behavioral Detection

Like anomaly detection, behavioral detection tools leverage AI and models of normal behavior. Because mobile malware commonly engages in unusual behavior, behavioral detection tools effectively identify potential mobile malware based on device activity.

Best Practices for Protect Against Mobile Malware

Most standard cybersecurity best practices apply to mobile malware. Several best practices specific to mobile malware include the following.

Use Secure Wi-Fi

Using password-protected Wi-Fi connections protects against man-in-the-mobile attacks. Like man-in-the-middle attacks, these attacks take advantage of public networks where threat actors position themselves as users and their intended audience. Threat actors can steal information and direct users to malicious sites by compromising the connection.

Do Not Jailbreak or Root Mobile Devices

Jailbreaking (typically referring to Apple devices) or rooting (typically to Android devices) involves removing software restrictions imposed by the manufacturer to give the user administrator-level access to the operating system.

While this enables extensive customization and the ability to install apps unavailable through the official app store, it increases the risk of infection from mobile malware.

Disable Features when Not in Use

Wi-Fi networks and Bluetooth connections are vulnerable points of access for mobile malware. To avoid exploitation by cybercriminals, these features and infrared should be deactivated when not in use.

Mobile Malware FAQs