An app should separate emulated environments from physical devices wherever a single attacker could otherwise act like thousands of users: account creation, promotions, referral rewards, identity checks and payments. Otukan detects Android emulators, virtual spaces that host cloned copies of your app, and iPhone apps running on a Mac, then applies the response you set for that flow and sends the signal to your backend. Emulators are also everyday tools for your own engineers, so Otukan keeps QA and approved automation working. It treats device farms of real phones as a pattern your server confirms, not a verdict made on the device.
For the full set of runtime checks, see mobile RASP.
Environment types
“Emulator” is used loosely for several different setups. They carry different risks and need different checks.
| Environment | What it is | Why attackers use it | How Otukan handles it |
|---|---|---|---|
| Emulator | Software that imitates a phone’s hardware on a computer or server | Runs many app instances cheaply, with scripting and easy resets | Hardware, sensor and system checks built per platform |
| Virtual space | A container app on a real phone that runs extra copies of other apps | Multiplies accounts on one handset for bonuses and referrals | Detection of the hosting container around your app |
| Mobile app on a desktop | An iPhone app running on an Apple silicon Mac | Desktop scripting and screen tools next to a genuine app | iOS checks for a Mac host |
| Device farm | Racks of physical phones, driven remotely | Passes simple hardware checks while scaling abuse | Environment context combined with reuse signals for your backend |
Android and iOS are different problems
Android offers many emulated images and container apps, and some are built to hide. Otukan’s Android checks look at hardware traits, sensors and the process around your app. On iOS, App Store builds do not run in Apple’s simulator. The realistic cases there are an iPhone app running on a Mac and a modified device, which iOS jailbreak detection addresses. Each platform gets its own checks and its own test plan.
Legitimate use
Your teams depend on emulators every day. Emulator detection that breaks your pipeline gets switched off, and then it protects nothing.
Build-based allowances
Otukan separates internal and QA builds from the release build. Engineers keep emulators, simulators and automated test runs; the build your users download enforces the policy. For the testing side, see protected mobile app testing.
Accessibility and unusual hardware
Some legitimate users run your app on a desktop, on a tablet with uncommon sensors or with assistive setups. Otukan tests its checks against these setups, and your policy decides what an uncertain result means for each flow.
Approved automation
Partners and internal teams may run sanctioned automation against production. Otukan lets you name those cases, so their traffic is recognised by your backend rather than blocked in the app.
Enforcement
Environment signals earn their place when they are tied to a specific abuse scenario. Otukan helps you connect the two.
| Abuse scenario | Where the environment signal helps | Typical policy |
|---|---|---|
| Fake account creation | Scripted sign-ups from emulators and virtual spaces | Block or step up at registration |
| Bonus and referral farming | Many accounts from cloned instances on one handset | Restrict reward redemption |
| Identity check bypass | Injected camera feeds are easier on emulated hardware | Refuse the identity step and alert your team |
| Game bots and cheating | Automated play on emulators | Separate matchmaking or restrict ranked play |
| Payment testing with stolen cards | Rapid, reset-and-repeat sessions | Restrict payments; share the signal with your fraud engine |
The signal reaches your backend with the request it concerns, where it can be combined with account history and velocity. For injected camera feeds, see camera injection detection. For voice input, audio injection detection flags virtual audio inputs and emulators.
Signals your server can combine
An emulator signal on its own says where the app is running, not who is running it. Its value grows when your backend combines it with what only the server knows: how old the account is, how many accounts share a payment method, how fast requests arrive. Otukan sends the environment signal in a form your risk logic can weigh next to those facts, so a legitimate tester on a desktop and a scripted sign-up campaign lead to different outcomes.
Proving the checks
Before a protected release ships, we work with your engineers in an authorised lab. The app is run on the emulators and virtual spaces you care about to confirm the signal, then on real devices across your supported range to confirm it stays quiet. Install, update, sign-in and the flow you protect are repeated, with versions, devices, results and the reviewer recorded.