Otukan protects your app and your customers from mobile malware by watching for what malware does to your app while it runs: drawing over screens, reading them through accessibility services, capturing keystrokes or driving the session remotely. When that behaviour appears during a sensitive step, Otukan applies the response you set, from recording the signal to pausing a payment, and sends the evidence to your backend. The protection lives inside your app, where malware has to act. Overlay and accessibility defences run on Android, where those techniques exist; on iOS, Otukan focuses on capture, mirroring and modified devices. Assistive and support tools keep working.
Behaviour coverage
Mobile malware aimed at apps, and at financial apps above all, reuses a handful of techniques. Otukan organises detection by behaviour rather than by malware name, so protection stays useful as new families appear.
Overlays
A malicious app draws a window over your login or payment screen. It imitates your screen to collect credentials, or covers a confirmation so the customer approves something they cannot see. This is an Android technique. Otukan detects when your sensitive screens are obscured and when touches arrive through another window, and on recent Android versions it asks the system to hide non-system overlays while those screens are shown.
Accessibility abuse
Accessibility services can read screen content and perform gestures. Malware that persuades a customer to enable one can read balances, collect one-time codes and tap through transfers. Otukan identifies which services are active, separates assistive tools from the rest and, where Android allows, marks sensitive views so that only services declared as accessibility tools can read them. iOS does not offer third-party apps this capability.
Keylogging
Input can be captured through a third-party keyboard, accessibility events or screen recording. Otukan uses the controls each platform provides. On iOS, secure text fields use the system keyboard, and Otukan can decline third-party keyboards across your app. On Android, Otukan asks keyboards not to learn from sensitive input and reports when a sensitive field is exposed to capture.
Remote control
A scammer persuades the customer to install a screen sharing or remote access tool, then watches or drives the session. Device and credentials are genuine, so Otukan looks at how the session is driven while a sensitive step is on screen: screen sharing and mirroring on both platforms, and on Android the remote access conditions that let another person tap through your app.
Platform boundaries
Otukan works inside your app and uses what each platform exposes to it. That is a precise, well-defined view, tuned per platform.
| Behaviour | Android: what Otukan uses | iOS: what Otukan uses |
|---|---|---|
| Overlays | Obscured-touch signals; hiding non-system overlays on sensitive screens | Third-party apps cannot draw over other apps |
| Accessibility abuse | Enabled services, within package visibility rules; sensitive-view marking | Third-party apps cannot act as accessibility services |
| Screen recording and sharing | Secure screens excluded from capture; capture notifications on newer versions | Capture and mirroring state; screenshot notifications |
| Keyboards | Requests that keyboards do not learn from sensitive input | Declining third-party keyboards |
| Modified device | Root indicators from mobile RASP | Jailbreak indicators from mobile RASP |
In-app detection and whole-device scanning are different jobs. Device-wide scanning belongs to platform protections and device security products, and needs permissions an ordinary app does not have. Otukan does the job only your app can do: catching abuse aimed at your screens in the moment it happens, responding on the spot and telling your backend.
Each behaviour signal is proven in an authorised lab with a test app that reproduces the behaviour, never with a customer’s device. The same journey is then run with the benign-tool baseline enabled to confirm the signal stays quiet or classifies the tool correctly.
Response that respects real users
Assistive and support tools keep working
Screen readers, switch access, password managers and the remote support tools your own help desk uses share capabilities with malware. Otukan tests against a baseline of legitimate tools before anything is enforced, and new signals start in observe mode so you see how often they fire on genuine customers.
The right response for each flow
Viewing a balance and approving a new payee are different moments. Otukan lets you record a signal, hide sensitive content while an overlay is present, pause an action or hand the step to your backend for confirmation through another channel, flow by flow. Final decisions stay on your server, where the fraud engine weighs the signal with account history.
Clear, safe next steps for the customer
“Security risk detected” on its own produces support calls. Otukan’s messages say what was noticed, why the step is paused and what to do: close the screen sharing app, review accessibility settings, or call your support team on a number the customer already trusts.
This control is part of mobile fraud prevention. Runtime integrity checks, which protect the malware signals themselves, are covered on mobile RASP. Masking protected screens against capture and snooping is covered on anti-spyware for mobile apps. For a structured way to evaluate options, see the malware detection solution guide.