A mobile security team should evaluate keylogging detection by testing each route keystrokes can leak through inside the app, on the fields that matter, with a clean device alongside as a control. There are three routes: the keyboard that receives the input, accessibility services that observe text, and screen capture while the customer types. Otukan watches all three on the fields you mark as sensitive and applies the response you set, from recording a signal to hiding the field. It works on Android and iOS separately. Confirming or removing an infection on the whole device is a job for device-level tools, not for an app.
Attack behaviour
Keylogging on mobile rarely looks like the desktop version. There is no hidden driver recording every key. Instead, malware borrows capabilities the operating system offers for good reasons.
The victim journey
A customer installs an app that promises a themed keyboard, a battery saver or a parcel tracker. It asks them to enable a keyboard, or an accessibility service, or to allow screen recording. From then on it waits. When the customer opens your banking app and types a PIN, the text travels through a component the attacker controls. The attacker does not need to break your app. They sit on the path between the customer’s fingers and your field.
Observable behaviour, route by route
| Capture route | What the attacker gains | Android | iOS |
|---|---|---|---|
| Keyboard | Every character typed into fields it serves | Third-party keyboards can serve most fields | Password fields use the system keyboard; other fields may use extensions |
| Accessibility events | Text changes and screen content | Services can observe much of the interface | Not available to third-party apps |
| Screen capture | Digits as they appear, masked-field previews | Recording and casting | Recording and mirroring |
| Instrumentation | Input read from app memory | Hooks on rooted devices | Hooks on jailbroken devices |
Where the stolen characters end up
A captured PIN is rarely used on the same phone straight away. It is sent to the attacker, who signs in from another device, resets a password or passes a one-time code to a remote operator. That is why Otukan’s keylogging signals travel with the login or payment request: your backend can link the risky entry to the session that follows and step up authentication before the stolen value is replayed elsewhere.
Detection limits
A good evaluation separates what an app can observe from what only the operating system or a device scanner can.
What your app can see
From inside your app, Otukan sees the input path of your own fields. It knows which keyboard is active on a sensitive Android field. On iOS, it lets your app decline third-party keyboard extensions. It can tell which Android accessibility services are able to read text, and whether the screen is being recorded or mirrored during entry. It also detects instrumentation hooked into your process. These are app-visible facts, and each one can be tested and reproduced.
What stays outside the app
Listing every installed app, scanning files or proving that a particular keyboard is malicious needs permissions an ordinary app does not hold, and on iOS the sandbox rules it out. Otukan reports what it saw in the session and leaves incident confirmation to your fraud analysts. That focus is what makes each signal precise, reproducible and defensible in a fraud case.
The implementation side is covered on protecting Android and iOS apps from keylogging malware.
Proportionate response
The goal is to protect a password without making the app feel hostile.
Match the control to the field
A search box needs nothing. A card number needs protection from capture. A PIN or password needs the strongest treatment: system keyboard on iOS, no learning or suggestions on Android, hidden from recording on both. Otukan lets you set the response per field, so everyday typing stays exactly as the customer likes it.
Keep a support path open
When a field is locked down, the customer should know why. Otukan’s message explains that a keyboard or service was paused for this step and how to continue. Your support team sees the same signal, so the conversation starts from facts. Customers who rely on assistive keyboards or screen readers are recognised in the baseline and are not blocked by default.
Prove it before enforcing
Run the positive test in an authorised lab, the clean-device control and a regression pass across install, update, sign-in and payment. Record OS versions, devices and the reviewer. Only then move a field from observe to protect.
Keylogging detection is one of the controls covered on mobile fraud prevention. Screen capture and snooping are covered on anti-spyware for mobile apps.