<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Mobile Phishing Apps

## APK Signing Verification
```bash
apksigner verify --print-certs target.apk
jarsigner -verify -verbose -certs target.apk
keytool -printcert -jarfile target.apk
```

## Package Identity
```bash
aapt dump badging target.apk | grep package
aapt dump badging target.apk | grep 'application-label'
```

## Overlay Attack Indicators
| Indicator | Location | Risk |
|-----------|----------|------|
| `SYSTEM_ALERT_WINDOW` | Manifest | Overlay drawing |
| `TYPE_APPLICATION_OVERLAY` | Source | Overlay creation |
| `BIND_ACCESSIBILITY_SERVICE` | Manifest | Input monitoring |
| `taskAffinity` | Manifest | Task hijacking |
| `allowTaskReparenting` | Manifest | StrandHogg |

## WebView Harvesting Indicators
| Indicator | Location | Risk |
|-----------|----------|------|
| `setJavaScriptEnabled(true)` | Source | JS execution |
| `addJavascriptInterface` | Source | JS-to-Java bridge |
| `loadUrl` with external URL | Source | Remote content |
| `evaluateJavascript` | Source | DOM manipulation |

## Digital Asset Links
```bash
# Verify app link ownership
curl -s "https://domain.com/.well-known/assetlinks.json" | jq .

# Expected format:
# [{"relation":["delegate_permission/common.handle_all_urls"],
#   "target":{"namespace":"android_app",
#     "package_name":"com.app",
#     "sha256_cert_fingerprints":["AA:BB:CC:..."]}}]
```

## Common Exfiltration Channels
| Channel | Pattern |
|---------|---------|
| Telegram Bot | `api.telegram.org/bot<token>` |
| Discord Webhook | `discord.com/api/webhooks/<id>/<token>` |
| Firebase | `<project>.firebaseio.com` |
| Custom C2 | IP addresses, DGA domains |
