Glossary
Mobile malware is malicious software designed to infect smartphones and tablets in order to steal data, harvest credentials, intercept communications, or take control of the device. As banking and identity moved onto mobile devices, so did the malware, and mobile banking trojans are now a leading enabler of account takeover and on-device fraud.
The mobile device is a high-value target precisely because it holds so much: banking apps, stored credentials, passkeys, authentication codes, and the trust that services place in a recognized device. Malware that compromises it can unlock all of that.
Once installed, mobile malware supports the full account-takeover and device-takeover playbook: overlay attacks that capture credentials by drawing fake login screens over real apps, interception of SMS one-time codes, keylogging of typed secrets, and remote control that lets fraudsters operate banking apps from within the victim’s trusted session. Because it works from inside the legitimate device, malware-driven fraud bypasses many controls that rely on device recognition.
For businesses, the key is not to trust the device blindly but to detect compromise. Mobile SDKs can identify indicators of malware, overlays, remote-access tools, tampering (rooting/jailbreaking), and emulation, feeding those signals into risk decisions so a session on a compromised device is treated as high-risk. Behavioral analysis adds another layer, spotting the unnatural patterns of malware-driven activity. For users, standard hygiene helps (installing apps only from official stores, keeping the OS updated, and avoiding suspicious links) but since even careful users get infected, the reliable defense is server-side and on-device detection that assumes any device might be compromised.
Understanding the infection routes helps explain why hygiene alone isn’t enough. Malware reaches devices through trojanized apps (including some that slip past app-store review, and many from unofficial stores or sideloading), phishing and smishing links that prompt a malicious download, fake system or app "updates," and social-engineering lures like fake security tools. Attackers frequently disguise malware as legitimate utilities or exploit the trust of a familiar brand. Android’s more open ecosystem sees more of this than iOS, but no platform is immune, and attackers continually evolve their delivery to evade detection. Because the delivery methods exploit user trust and evolve constantly, catching infected devices at the point of a transaction (through on-device and behavioral signals) is more reliable than trying to prevent every infection.
How does mobile malware get onto a device?
Through trojanized or fake apps, sideloading, phishing/smishing links, fake updates, and social-engineering lures disguised as legitimate tools.
What is mobile malware?
Malicious software targeting smartphones and tablets to steal data or credentials, intercept communications, or control the device.
What is a banking trojan?
Mobile malware that targets financial apps, often using overlay attacks to steal credentials and intercept transactions.
How does mobile malware enable account takeover?
Through overlays, SMS interception, keylogging, and remote control that operate from inside the trusted device.
How do you defend against mobile malware?
On-device detection of malware, overlays, remote access, and tampering via SDKs, plus behavioral analysis and user hygiene.
Related: Device Takeover · Remote Access (RAT) Attacks · Emulator Detection · Behavioral Biometrics · Account Takeover (ATO)
