Today, everyone has smartphones, from children to elders. Smartphones contain a bunch of applications that increase productivity in real life. Humans today may spend time with smartphones even more than with other people. Smartphones have become a part of life, an accessory, and maybe a secret holder for everyone. People put almost everything in their phones, from photos and identities to bank accounts. This habit makes smartphones a top priority target for hackers in hacking campaigns, to steal secrets or simply money. These hacking campaigns usually exploit users’ low awareness or knowledge about mobile app security factors. Android and iOS, by default, provide many mechanisms to protect users from getting hacked, but the weakest point in the system is always human psychology. “Amateurs hack machines, Professionals hack people.” If you are afraid of hacking, this post is for you. This post hopefully can guard your mind against one of the highest risk factors in the Internet era: cybercrime.
Most cyber security incidents—commonly referred to as getting hacked—known to the public begin with a very non-technical step that can be performed by anyone, called Social Engineering. Social Engineering is a type of manipulation where someone tricks people into giving away sensitive information, access, or money—by exploiting human psychology rather than hacking systems. To steal data from your phones, 99% of the time, hackers need to trick you into installing malicious applications. Malicious applications, once installed, will silently steal data and send it back to the hackers. So, just by recognizing which apps can be malicious, you can already keep yourself safe 99% of the time. The remaining 1% involves Zero-Day exploitations, which are real hacking, requiring top-notch hacking knowledge and skills, but will not be mentioned in this post. For a better understanding of Zero-Day exploitations, you can subscribe here, and then the-tech-lead.com will inform you when there is any article available.
Here we are back to How to know if a mobile app is malicious!
1. Double Attention to Download Source
As a golden rule for mobile applications, only download from trusted stores, namely the Play Store and App Store. The Play Store and App Store are pre-installed on all Android and iOS smartphones. For any applications, only download from the Play Store app (for Android phones such as Samsung, Pixel, Nexus, etc.) and the App Store app (for iPhones). Do NOT install any applications outside of these two official stores, regardless of any reasons, urgency, or who tells you.
For the Android world, mobile applications are written in Java and Kotlin, exported as APK files (files with the .apk extension). These .apk files are then signed with a digital signature from their owner, who is registered as a developer on the Play Store with their legal information. This process is essential, as it identifies who is actually behind an application, and if we have evidence of any malicious activities, we know whom to sue. The information about who developed a certain application can be found in the “App Support” section under its logo.
APK files can be installed directly to an Android phone via the user’s explicit consent. Users can tap on .apk files stored on their phone (in the Download folder or the Documents folder, for example), and a popup will display asking for installation permission. If the user grants it, the .apk will be installed. This process is usually intended for developers to test applications before submitting them to the Play Store. For regular users, this process is a strong indicator of a malicious application. Therefore, if someone tells you to follow these steps manually for any reason, do not trust them and report them to the police as soon as possible. A typical trick flow is as follows:
- You are on a social network such as Facebook, seeing a post that tells you to install an application to get a free $1000 as a reward for its early users.
- You click on the download link, and your phone downloads it into the Download folder.
- You follow the “installation guide” written next to the download link, which states that you should open the Settings app, enable “install apps from unknown sources,” then open the Download folder and tap on the APK file.
- Your Android phone shows a popup telling you that the APK is from an unknown source, but according to the guide, it tells you to just press Accept.
- Then the malicious APK is installed, and it steals your data.
Similarly, in the iPhone world, iOS applications are written in Swift and Objective-C languages and are exported as .ipa files. IPA files can be installed via the App Store or through developer tools like Xcode. Usually, we can’t freely install IPA files unless the app is signed with a valid certificate or the iPhone is registered for development. However, there is still a trick that hackers can use to get users to install malicious IPA files: abusing TestFlight. TestFlight is Apple’s official tool for distributing beta (testing) versions of iOS apps before they go public on the App Store. Developers use it to invite testers, collect feedback, and fix bugs before release. TestFlight is legitimate—but it can be abused in social engineering attacks. The typical trick flow is as follows:
- Someone impersonates a bank employee, calls you, tells you exactly your name, your address, and says “Your bank account is at legal risk due to a transfer from a criminal gang” or “The police is screening your account because they think you are laundering money,” with an urgent, serious, and slightly threatening tone.
- Then they sent you a link to install their internal iOS app to prove your innocence.
- You tap on that link, and your iPhone redirects you to the TestFlight app because it is a TestFlight invitation link, and your iPhone does not have TestFlight installed.
- Then you are told to tap on the link again; this time, the fake application is installed on your iPhone via TestFlight.
- The fake app looks the same as the bank’s official application, so you have no doubt.
- But the app then steals data from your iPhone or tricks you into filling in your username, password, even OTP, and CVV number.
2. Double Check App Permissions
When users are smart enough not to install apps from untrusted sources anymore, hackers may use level 2 of malice: camouflage. A typical hacking plan is as follows:
- This time, hackers develop or purchase regular mobile application source code and then publish it via the Play Store and App Store as usual.
- Because it is normal, the Play Store and App Store accept it and make it available.
- Then the hacker sends the next updates for the normal application, with new features requiring some system permissions such as: reading the contact list, reading call logs, reading the gallery, reading GPS, etc.
- Hackers advertise that the app has awesome features that can produce outstanding outcomes, right in need of some users.
- Then, with curiosity, users install the app from the Play Store or App Store, depending on their phone’s OS.
- The app requires users to grant quite a lot of permissions, but they usually don’t care and don’t understand, so they just accept them.
- Then the app steals call logs, photos, location data, etc., from the phone, thanks to the user’s grant.
Both Android and iOS have default safeguards to protect users’ privacy. Every application, by default, cannot access sensitive data on a smartphone. For example, if an application wants to read some photos, the developer who is making that application must register for “Access Gallery” permission. Then, whenever the application wants to use this permission, the operating system (Android/iOS) will display a message asking users to grant that permission. When granted, the application can now see photos on the phone. Similarly, other sensitive information such as call logs, GPS, and many more also requires user permission before the app can actually read the data. To know what permissions an application wants, we can check right on the Play Store for Android apps and the App Store for iOS apps.
2.1. How to Check Permissions of an Android Application
Before installing:
- Open the app page in the Google Play Store.
- Scroll down to “App info” → “Permissions.”
- Tap “See more” to view the full details
- Check what the app can access:
- Location
- Contacts
- Storage
- Microphone, etc.
After installing:
- Go to Settings → Privacy → Permission Manager.
- Select a permission (e.g. Location)
- See which apps are using it
- You can:
- Allow
- Allow only while using
- Deny
👉 Tip: Android also shows permissions during the first use, so don’t just tap “Allow” automatically.
Here’s a practical mapping of common Android permissions you’ll see on the Google Play Store, as well as the features that legitimately use them. This mapping helps you judge whether a request makes sense.
2.1.1. Android Permissions & Legit Features
| Permission | Legit Features | Suspicious If … |
| Read Contact, Write Contact | Messaging apps (find friends) Contact backup/sync Invite friends feature | Suspicious if a simple game or flashlight asks for this |
| Read Call Log, Read Phone State | Caller ID / spam detection apps Dialer & call management | Suspicious if: unrelated apps request call history |
| Read SMS, Send SMS | Messaging apps OTP auto-fill | High Risk: can intercept verification codes Recommend: NEVER download |
| Access Fine Location, Access Coarse Location | Maps & navigation Ride-hailing / delivery Weather apps (local forecast) | Suspicious if: calculator or offline app asks for precise location |
| Read External Storage, Media Access | Upload photos (social media) File managers Image/video editing apps | Suspicious if: app doesn’t handle files but asks access |
| Record Audio | Voice messages / calls Recording apps Voice assistants | Suspicious if: no voice feature exists |
| Camera | Taking photos/videos QR/barcode scanning Video calls | Suspicious if: app has no visual capture feature |
| Notification access | Notification managers Smart reply apps | High risk: these app can read OTPs and messages, Recommend: NEVER download |
| Accessibility Service | Screen readers (for visually impaired) Automation tools | High Risk: these app can control screen, read inputs, commonly abused in scams Recommend: NEVER download |
2.2. How to Check Permissions of iOS Applications
Before installing:
- Open the app page on the App Store
- Scroll to “App Privacy” section
- Review what data the app may collect:
- Location
- Contacts
- Identifiers
- Usage data
- etc …
After installing:
- Go to Settings → Privacy & Security
- Tap a category (e.g. Location, Photos, Microphone)
- Select the app
- Choose access level:
- Never
- Ask Next Time
- While Using
- Always (for location)
Review these permissions carefully. Anticipate which features require them. If there are too many permissions compared to the expected features, it is a red flag.
Here’s a practical mapping of common iOS permissions you’ll see on the App Store, as well as the features that legitimately use them. This helps you judge whether a request makes sense:
2.2.1 iOS Permissions & Legit Features
| Permission | iOS Permission Name / Key | Common Legit Features | Suspicious If… |
|---|---|---|---|
| Contacts | Contacts (NSContactsUsageDescription) | Messaging, contact sync, invite friends | Game or simple app requests it |
| Location (GPS) | Location (NSLocationWhenInUse / Always) | Maps, ride-hailing, delivery, weather | App doesn’t need location |
| Photos / Media | Photos (NSPhotoLibraryUsageDescription) | Upload images, editing apps | App doesn’t use images/files |
| Camera | Camera (NSCameraUsageDescription) | Photos, video calls, QR scanning | No camera-related feature |
| Microphone | Microphone (NSMicrophoneUsageDescription) | Voice calls, recording, voice input | No audio-related feature |
| Bluetooth | Bluetooth (NSBluetoothAlwaysUsageDescription) | IoT devices, wearables, accessories | App has no hardware/device interaction |
| Notifications | Notifications (UNUserNotificationCenter) | Alerts, messages, reminders | Spammy or excessive notifications |
| Tracking | App Tracking Transparency (ATT) | Ads personalization, analytics | App unrelated to ads asks for tracking |
| Local Network | Local Network (NSLocalNetworkUsageDescription) | Smart home, device discovery | No local device interaction |
| Motion / Fitness | Motion (NSMotionUsageDescription) | Fitness apps, step tracking | App unrelated to activity tracking |
2.3. Simple Rules for Evaluating Permissions
When you are considering installing a new mobile application:
- Anticipate what functions the app may have,
- Check the permissions that the app requires
- Then ask yourself: “Does this feature really need this permission?”
If there are permissions that are not aligned with expected functions:
- Then slow down; don’t rush to install for any reason.
- Find alternative applications and compare permissions among them.
- If you are not sure but want to check the app, use emulators to test it first. Emulators are virtual smartphones and can be created via tools such as Genymotion, VirtualBox, and a few others. Emulators are isolated environments and do not contain your data.
- If you know any experts in the cybersecurity field, ask them for advice.
3. Monitor Phone’s Performance
Welcome to Level 3 of Malice: Zero-Day Exploitation.
Thanks to the strict review process of the App Store and Play Store, most malicious mobile apps are banned. However, optimism is not a recommended trait in the cybersecurity field. Zero-day vulnerabilities are those that are unknown to the public, even among experts, and in fact, they are weaponized by many governments as a national strength.
Android & iOS are software. Software might have bugs and security holes. These vulnerabilities are actively hunted by experts in the cybersecurity industry and sponsored by governments. Once a zero-day is discovered, it becomes a secret weapon for cybercriminal groups to attack or infiltrate systems around the world. Mobile apps are not immune. If there are vulnerabilities in operating systems, such as Android or iOS, then they will be the target for level 3 of malice.
Although it is rare, it is still a case for us – regular users – to keep an eye on. After installing an application from Google Play Store or App Store, pay attention to device performance:
- whether it gets slower,
- or hotter,
- or gets lagged
- or any abnormal behavior.
Vulnerabilities have many forms; it is hard to explain them all in a single post here, but many of their types create a significant workload on a device while exploiting, causing the phone to become slower, hotter, or laggy.
3.1. Pegasus: A Well-Known Spyware
One of the most well-known cases of this level 3 malice involves commercial spyware: Pegasus, developed by NSO Group. This spyware has successfully stolen sensitive data from users’ phones, often without any visible permission prompts. The trick flow is as follows:
- NSO Group delivers Pegasus via app or link. Target users receive a message that tricks them into installing the app. The app looks absolutely normal since it requires minimal permissions.
- Once installed, hidden zero-day exploit triggers. The app or content inside it exploits an unknown vulnerability in Android.
- Privilege escalation: The exploit gains deeper system access than normal apps should have, bypassing Android’s sandbox protections.
- Silent data access: The NSO Group can access messages, camera/microphone, and location without the user’s awareness.
These attacks are extremely expensive and are used for targeted surveillance, not mass scams. Once the exploit method is discovered, it can be quickly patched by the developers behind the Android and iOS systems. But the problem is that it is really hard to discover.
There isn’t just one single CVE for Pegasus; it has used multiple zero-day vulnerabilities over time, often chaining several together. Here are some of the most well-known ones:
3.2 Notable CVEs Linked to Pegasus Campaigns
3.2.1. FORCEDENTRY exploit chain (2021)
- CVE-2021-30860
- Affected: iOS (Apple devices)
- Type: CoreGraphics / PDF parsing vulnerability
What it did:
- Delivered via iMessage (no user interaction needed)
- Exploited how the system processed malicious image/PDF data
- Led to full device compromise
👉 This was one of the most advanced zero-click exploits ever discovered
3.2.2. WhatsApp exploit (2019)
- CVE-2019-3568
- Affected: WhatsApp on Android & iOS
- Type: buffer overflow in VoIP call handling
What it did:
- Attacker placed a WhatsApp call
- Even if you didn’t answer → exploit could trigger
- Installed spyware silently
3.2.3. Chrome sandbox escape (used in chains)
- CVE-2020-6418
- Affected: Google Chrome (Android)
What it did:
- Used as part of a chain to escape browser sandbox
- Combined with other bugs to gain deeper access
3.2.4. KISMET (suspected chain, 2020)
- No single confirmed CVE publicly disclosed
- Targeted iMessage (iOS 13)
What it did:
- Zero-click exploit (no interaction)
- Predecessor to FORCEDENTRY
To understand more about these CVE in the future, please subscribe so when the-tech-lead.com post any, you will be informed. Each of CVE deserves a long post itself.
Build – Secure – Evolve with the-tech-lead.com