Evaluate mobile malware detection by the behaviour a solution can observe from inside your app, not by the size of a signature list. A banking or payments app cannot scan the whole phone; it can see what touches its own screens, inputs and process. So test three things: which attacker behaviours become signals in the journeys fraudsters target, where app-visible detection ends and device scanning or incident confirmation begins, and whether responses protect money without shutting out genuine customers. Android and iOS are scoped separately, because their malware risks differ sharply. Otukan turns malware behaviour into signals your fraud and security teams can act on.
The control itself is covered on mobile app malware detection.
Attack behaviour
Mobile banking malware rarely announces itself. It waits for a sensitive moment, then watches, covers or drives the screen on the victim’s behalf. Describe that journey before you compare any product.
Victim journey
- How does malware reach your users: sideloaded apps, fake update prompts, links in text messages?
- Which moment in your app does it target: sign-in, adding a payee, confirming a transfer, reading a one-time code?
- On Android, which permissions does it abuse: accessibility services, drawing over other apps, notification access, screen capture?
- On iOS, which routes matter for your users: jailbroken devices, sideloaded apps, configuration profiles installed after a persuasive phone call?
Behaviour-to-signal matrix
| Behaviour | Platform | What your app can observe |
|---|---|---|
| Fake screen drawn over sign-in or payment | Android | Another window placed above the app while sensitive input is showing |
| Accessibility service reading or driving the interface | Android | An enabled service able to read content and perform gestures |
| Recording or mirroring a sensitive step | Android and iOS, differently | Android: the app can exclude sensitive windows from capture, and recent versions report recording of the app; iOS: the system indicates that the screen is being captured or mirrored |
| Code injected into the app process | Android and iOS | Hooking frameworks and altered app code |
| Remote takeover of the session | Android | Assistive control combined with screen sharing during input |
How Otukan answers. On Android, Otukan detects windows obscuring your sensitive screens, identifies enabled accessibility services and recognises remote access that lets someone else drive the session. On Android and iOS, it detects screen recording, sharing and mirroring during sensitive steps, along with hooking frameworks and modified code. Each detection arrives at your backend as a runtime threat signal tied to the moment it happened, so your team sees the attack in the context of the journey.
Detection limits
Be precise about what an app-level control is. It sees the app’s own process and the device conditions the operating system chooses to reveal. It is not antivirus, and it does not replace incident response.
App-visible signals
- Which signals come from the app’s own process, and which depend on information the operating system shares?
- On Android, how does the solution work within package visibility rules and Google Play policy, which limit the installed apps an app may query?
- On iOS, where the sandbox keeps apps from inspecting one another, which signals are available at all?
Scanning and incident confirmation
- Does the option describe its output as a malware verdict or as a risk signal, and can it explain the difference?
- Who confirms an incident: your fraud team, your security operations team or the supplier?
- What evidence does a signal carry for a later investigation or a customer dispute?
| Question | App-level signal | Whole-device assessment |
|---|---|---|
| What is inspected | The app’s process, windows and inputs | Installed software across the device |
| Who controls the device | Your customer | Your organisation, through device management |
| Typical owner of the verdict | Fraud or security team, using the signal | Security operations, using device tooling |
How Otukan answers. Otukan works from inside your app. It reports what it observes, such as overlays, assistive control, capture and injection, as signals with context rather than as a verdict on the whole phone. Your fraud and security teams decide what a pattern means. Where your organisation owns the device, whole-device assessment belongs with device management.
Response
A response that is too hard costs you customers; one that is too soft costs them money. Test both directions.
Proportionate controls
- Can you set a different response for viewing a balance, adding a payee and approving a transfer?
- Can the app hide sensitive fields or pause input while an overlay is present, rather than closing?
- Can your backend hold a transaction for review because of a signal?
Legitimate users and tools
- Have you tested on clean devices, and on devices running screen readers, switch access and other assistive services?
- What does the customer see when a response triggers, and how do they reach support?
- How is a customer released after a wrong restriction, and who approves it?
| Flow | Signal | Example response |
|---|---|---|
| Viewing a balance | Overlay present | Observe and record |
| Adding a payee | Assistive service driving input | Warn and confirm through a second channel |
| Approving a transfer | Code injection in the app | Restrict and hold the payment for review |
| Any flow | Pattern confirmed by your fraud team | End the session |
How Otukan answers. You set observe, warn, restrict or terminate per flow, and your backend can blend Otukan signals with transaction risk. The app can act before money moves: on Android, Otukan hides non-system overlays on sensitive screens and excludes them from capture; on iOS, it hides sensitive content while recording or mirroring is active. Otukan reports which assistive capability is active, so your policy can treat a screen reader differently from a service performing gestures during a payment.
Related controls are covered on overlay attack detection, accessibility abuse detection and mobile app anti-spyware.