<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-mobile-phishing-apps
description: >-
  Identify phishing and fake mobile applications through UI similarity analysis,
  certificate verification, overlay attack detection, intent filter abuse, and
  WebView-based credential harvesting on Android and iOS.
domain: cybersecurity
subdomain: mobile-security
tags:
  - phishing
  - fake-apps
  - overlay-attack
  - webview
  - credential-harvesting
  - ui-redressing
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1660", "T1417", "T1414"]
  owasp-mobile: ["M1", "M8"]
  tools: ["apktool", "jadx", "mobsf", "androguard"]
---

# Detecting Mobile Phishing Apps

## Overview

Mobile phishing apps impersonate legitimate applications to steal credentials
through overlay attacks, fake login screens, WebView-based harvesting, and
deep link hijacking. Detection involves analyzing UI similarity, intent filters,
WebView configurations, and network destinations for credential exfiltration.

## Prerequisites

```bash
pip install androguard ssdeep
apt install apktool
# jadx for Java decompilation
```

## Workflow

### Step 1: App Identity Verification

```bash
# Check signing certificate
apksigner verify --print-certs target.apk
jarsigner -verify -verbose -certs target.apk

# Compare certificate with legitimate app
keytool -printcert -jarfile legitimate.apk > legit_cert.txt
keytool -printcert -jarfile suspect.apk > suspect_cert.txt
diff legit_cert.txt suspect_cert.txt

# Check package name similarity
aapt dump badging target.apk | grep package
# Typosquatting: com.target.app vs com.targ3t.app vs com.target.app.free
```

### Step 2: Overlay Attack Detection

```bash
# Check for SYSTEM_ALERT_WINDOW permission
grep 'SYSTEM_ALERT_WINDOW' apktool_out/AndroidManifest.xml

# Check for TYPE_APPLICATION_OVERLAY usage
grep -rn 'TYPE_APPLICATION_OVERLAY\|TYPE_SYSTEM_ALERT\|TYPE_PHONE' jadx_out/
grep -rn 'WindowManager.LayoutParams' jadx_out/

# Check for accessibility service abuse
grep -rn 'AccessibilityService\|onAccessibilityEvent' jadx_out/
grep 'BIND_ACCESSIBILITY_SERVICE' apktool_out/AndroidManifest.xml

# Check for task affinity hijacking
grep 'taskAffinity' apktool_out/AndroidManifest.xml
grep 'allowTaskReparenting' apktool_out/AndroidManifest.xml
```

### Step 3: WebView Credential Harvesting

```bash
# Check for WebView with JavaScript enabled
grep -rn 'setJavaScriptEnabled(true)' jadx_out/
grep -rn 'WebViewClient\|shouldOverrideUrlLoading' jadx_out/

# Check for JavaScript interfaces (data bridge)
grep -rn 'addJavascriptInterface' jadx_out/

# Check for URL spoofing in WebView
grep -rn 'loadUrl\|loadData' jadx_out/
# Look for: external URLs loading login forms
# Look for: JavaScript injection to capture form data

# Frida: Monitor WebView URLs at runtime
frida -U -f com.suspect.app -l webview_monitor.js --no-pause
```

```javascript
// Monitor WebView URL loading
Java.perform(function() {
    var WebView = Java.use('android.webkit.WebView');
    WebView.loadUrl.overload('java.lang.String').implementation = function(url) {
        console.log('[WEBVIEW] Loading: ' + url);
        this.loadUrl(url);
    };

    var WebViewClient = Java.use('android.webkit.WebViewClient');
    WebViewClient.onPageFinished.implementation = function(view, url) {
        console.log('[WEBVIEW] Finished: ' + url);
        // Inject JS to check for login forms
        view.evaluateJavascript(
            "document.querySelectorAll('input[type=password]').length",
            null);
        this.onPageFinished(view, url);
    };
});
```

### Step 4: Intent Filter and Deep Link Abuse

```bash
# Check for intent filters targeting other apps' URLs
grep -A10 'intent-filter' apktool_out/AndroidManifest.xml | grep -E 'scheme|host|path'

# Look for deep link hijacking
# Legitimate app: myapp://login
# Phishing app also registers: myapp://login

# Check for browsable activities catching URLs
grep -B5 -A10 'BROWSABLE' apktool_out/AndroidManifest.xml

# Verify app links (Digital Asset Links)
curl -s "https://target.com/.well-known/assetlinks.json" | jq .
```

### Step 5: Network Exfiltration Analysis

```bash
# Extract all URLs and endpoints
strings target.apk | grep -E 'https?://' | sort -u

# Check for credential exfiltration endpoints
grep -rn 'login\|signin\|auth\|password\|credential' jadx_out/ | grep -i 'http\|url\|post'

# Compare network destinations with legitimate app
# Phishing indicators: different domains, IP addresses, Telegram bot APIs

# Check for Telegram/Discord bot exfiltration
grep -rn 'api.telegram.org\|discord.com/api\|webhook' jadx_out/
strings target.apk | grep -E 'bot[0-9]+:|webhook'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Certificate mismatch | APK signature | Different signer than official |
| Overlay permission | Manifest | SYSTEM_ALERT_WINDOW requested |
| WebView harvesting | Source code | JS-enabled WebView loading login URLs |
| Bot API exfiltration | Strings/code | Telegram/Discord credential forwarding |
| Deep link hijack | Manifest | Intercepting another app's URL scheme |

```yaml
title: Mobile Phishing Apps Detection
id: 848cbf1b-4e3a-4bcf-8318-b21a8eadc369
status: experimental
description: Detects suspicious activity related to detecting mobile phishing apps techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1660
  - attack.t1417
  - attack.t1414
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] App signing certificate verified against legitimate publisher
- [ ] Overlay attack capabilities assessed
- [ ] WebView configurations reviewed for harvesting
- [ ] Intent filters checked for deep link hijacking
- [ ] Network exfiltration endpoints identified
- [ ] UI compared with legitimate app for similarity

## References

- [OWASP MASTG — UI Testing](https://mas.owasp.org/MASTG/)
- [StrandHogg Vulnerability](https://promon.co/strandhogg-2-0/)
- [MITRE T1660](https://attack.mitre.org/techniques/T1660/)
- [MITRE T1417](https://attack.mitre.org/techniques/T1417/)
