Mobile Application Security Glossary.

The successful, unauthorized access to and control of a legitimate user's account. ATO is the end goal of many other attacks, including phishing, credential stuffing, malware, and social engineering.

A protective layer that scans the device for the presence of known malware, spyware, and Potentially Unwanted Applications (PUAs) like auto-clickers, screen recorders, and virtual camera apps. It can use signature-based detection, heuristic analysis, and behavioral monitoring to identify threats on the device that could interfere with the protected application.

A specific form of static tampering where an attacker directly alters the executable code or library files within the application package on disk. This is often done to permanently disable security controls, unlock features, or inject malicious startup logic.


The process of transforming an application's executable code (e.g., DEX files) and resources into encrypted ciphertext. At runtime, a secure, protected loader mechanism is responsible for decrypting and loading this content into memory. The security of this protection is entirely dependent on the robustness of the runtime decryption logic and key protection.

The insertion of malicious or unauthorized code into an application, either statically (by patching the binary) or dynamically (at runtime via hooking). The goal is to alter behavior, bypass security logic, or extract data.

Automated attempts to gain access to end user accounts via stolen or guessed login credentials; they often exploit weak authentication flows.

A debugger exists to identify bugs or faults in software. It attaches itself to the process of the target application and can enable a bad actor to inspect the app’s state. 

Transforming compiled binary machine code into a reconstructed version of the original source code; decompilation is often the first step attackers will take when targeting an application.

Device Attestation detects when emulators are being used, when a device has root privilege (or has been jailbroken), and when it is running custom firmware. Device attestation mechanisms such as root and emulator detection may also sometimes be categorised as RASP mechanisms.

The process of cryptographically linking a user's account or session to a specific, verified instance of the application on a particular device. This makes sure that stolen session tokens or credentials cannot be easily used on a different device, making account takeovers significantly more difficult.

The practice of fingerprinting a device and its environment to create a unique identifier and risk profile. It goes beyond attestation by collecting hundreds of data points (OS version, network details, hardware identifiers, installed apps, and more) to detect anomalies, identify emulators, and assess the risk associated with a particular device session.


Applications or SDKs used for user authentication and digital ID storage. Attackers often try to steal or spoof identity credentials through device tampering, root exploits, or virtual interface manipulation.

The analysis of an application's behavior while it is executing. This is typically performed in a controlled environment (like an emulator or an instrumented device) to observe runtime data, network traffic, and API calls, often to discover vulnerabilities that are not apparent statically (DAST).

A technique for analyzing the behavior of a compiled application by injecting code into it as it runs. This allows for monitoring and modification of the application's execution flow at the instruction level. The most popular DBI framework for mobile is Frida.


Bad actors can circumvent the ID verification process using virtual camera apps and AI. This allows them to open accounts fraudulently and take out loans or apply for credit. Dealing with the fallout of eKYC fraud costs banks large quantities of time and money.

SDKs (Software Development Kits) integrated into mobile applications to perform digital ID verification. These SDKs are vulnerable to fake camera input, virtual environments, and overlay attacks aimed at bypassing identity checks.

How to tackle the growing threat of eKYC fraud.

The use of software to create an environment where a mobile app can run outside of a physical device. Emulators mimic the hardware architecture (e.g., running an ARM-based Android OS on an x86 computer). On-device virtualization apps create a contained, separate OS environment on the phone itself. Attackers use both to gain deep control, bypass hardware-based security, and automate attacks.

Advanced malware that specifically targets financial applications. Modern trojans can abuse Accessibility Services to perform Automated Transfer Systems (ATS), intercept 2FA codes from SMS or notifications, log keystrokes, and use overlays to steal credentials.

A runtime technique used to intercept and alter function calls, method executions, or system API calls within a running application. It's a core component of dynamic instrumentation frameworks like Frida or Xposed, enabling attackers to monitor and manipulate app behavior in real-time.

Software that automates user input events like taps, swipes, and text entry, often by abusing Accessibility Services. This enables attackers to script fraudulent actions at scale, such as bulk transaction creation or ad fraud, without human interaction.

The use of software tools to substitute a live camera feed with a pre-recorded video or a manipulated image. This is a common attack vector for bypassing liveness detection and other identity verification (eKYC) processes that rely on camera input.

An attack where a bad actor intercepts and potentially alters communication between the mobile app and its backend server. This is commonly executed by persuading the device to trust an attacker-controlled Certificate Authority (CA), allowing for the decryption of TLS/SSL traffic, or by exploiting misconfigurations in the app's network security.


The act of extracting a snapshot of an application's memory (RAM) while it is running. Attackers do this to find sensitive data that has been decrypted for use, such as API keys, user session tokens, or cryptographic keys, bypassing storage encryption.


A security control, also known as Client Attestation, that ensures API requests are coming only from a trusted, unmodified instance of the mobile app. It works by having the app generate a cryptographic proof-of-integrity (a signature or token) for each API request, which the backend server validates. This blocks bots, scripts, and tampered clients from abusing the API.


Mobile apps developed by financial institutions that allow users to access banking services. These applications are prime targets for mobile malware, Account Takeovers, and eKYC fraud.

Read our mobile banking case study.

Applications, SDKs, and APIs involved in facilitating payments. These systems require layered protection to prevent Mobile API abuse, fraud automation, and data breaches.

Applications used to store, manage, and transfer digital payments or credentials. They must protect sensitive data like card tokens and user credentials from extraction, cloning, and tampering.

Read our Mobile Wallets use case.

A set of transformations applied to an application's code and metadata (class/method/field names, strings) to make it computationally difficult and time-consuming for a human to reverse-engineer. Obfuscation is a deterrent that raises the cost and complexity of static analysis, but does not alter the app's logic.

An attack where a malicious app draws a fake window on top of a legitimate app's UI to capture user input. This technique, also known as tapjacking, is used to steal credentials, authorize fraudulent transactions, or capture other sensitive information.

The act of creating a trojanized version of a legitimate app. This involves decompressing the original application package, modifying its code or resources, and then re-signing it with an attacker's certificate before distributing it.

The comprehensive process of deconstructing and analyzing a compiled application to understand its internal logic, architecture, algorithms, and data flows. It encompasses both static analysis (like decompilation) and dynamic analysis (like runtime instrumentation).

Devices where the user has gained administrative (root) access, thereby disabling the core operating system's security model, including the application sandbox. This allows the user and any malicious apps to bypass system-wide restrictions, access other applications' data, and load powerful instrumentation frameworks required for hooking and tampering.

A security technology that enables an application to detect and actively respond to attacks in real-time. It monitors for signs of dynamic analysis and tampering—such as attached debuggers, active instrumentation frameworks (Frida), or hooking attempts, and can trigger responses like terminating the session, alerting a server, or shutting down the app.

A security mechanism where the application, at runtime, verifies that its own code and resources have not been modified. This is typically done by comparing the checksums or cryptographic signatures of its files on disk against known-good values embedded within the app.

DexProtector takes it even further, applying proprietary techniques to achieve the highest possible levels of integrity control that have highest levels of resistance to static and dynamic interference.

The programmatic capture of the device's screen content. This can be performed by malicious applications (often abusing Accessibility or MediaProjection APIs) to steal sensitive information displayed on the UI, such as credentials, balances, or one-time passwords.

The practice of storing sensitive data (keys, tokens, user data) within an encrypted, tamper-resistant container inside the application's private storage. This goes beyond simple file encryption and often leverages platform hardware (like the Android Keystore or iOS Secure Enclave) or white-box techniques to protect the storage encryption keys themselves.


Software-based POS systems that transform smartphones into payment terminals. SoftPOS applications face strict compliance requirements and are frequent targets of emulator abuse, reverse engineering, and tampering.

Read our SoftPOS use case.

A broad term for protecting cryptographic operations and keys in software when hardware protection is unavailable or insufficient. It is an umbrella category that includes techniques like white-box cryptography, obfuscation, and anti-debugging applied specifically to the cryptographic logic to make tracing the code and extracting secrets computationally infeasible.

The act of analyzing an application’s code and resources without executing it. This is often done on the application package (APK/IPA) to discover secrets, vulnerabilities, and intellectual property, or to prepare for code modification.

Any unauthorized modification of an application that violates its intended integrity. This is a broad category that includes binary patching, resource modification, configuration changes, and runtime manipulation.

A system that collects, aggregates, and correlates security event data from a large population of instances of a protected application. This collective intelligence allows for the proactive identification of emerging threats, new malware variants, attack infrastructure, and fraudulent activity patterns that would be invisible from the perspective of a single device.

Any API request made to a mobile application's backend that does not originate from a genuine, untampered instance of the official mobile app. This includes bots, scripts, custom tools, outdated app versions, and repackaged apps, all of which attempt to interact directly with the API to exploit business logic or steal data.

An advanced code protection technique that transforms an application's original bytecode into a new, proprietary instruction set for a custom virtual machine (VM). The protected application then includes a VM interpreter to execute this virtualized code at runtime. This renders standard decompilers useless and forces an attacker to reverse-engineer the entire custom VM architecture, which is a significantly more complex task.

A set of techniques for implementing cryptographic algorithms in a way that embeds the cryptographic key directly within the algorithm's implementation. This code is heavily obfuscated and designed to remain secure even if an attacker has full visibility and control over the execution environment (the "white-box" attack model).