mobile runtime attacks

Each attack is a technical phenomenon — documented, named, observable.

Thirteen attack classes that operate in the mobile runtime, plus one regional threat-intel report. Each entry covers the mechanism, the syscalls and APIs it touches, which checkpoints it bypasses, the EEI signal class that makes it observable, and the Evidence Token shape produced when the substrate sees it. Reusable inside a security review or fraud-team briefing without rewriting.

14 articles · attack catalogue · cite as published

attack catalogue · class · signal · entry

The signal-class column maps each attack to the field on the Evidence Token that surfaces when the substrate observes the technique in production. Five classes cover the catalogue: device.integrity, runtime.environment, code.integrity, binding.status, network.identity.

#	attack	attack class	EEI signal class
01	Overlay injection — system-overlay UI manipulation on Android	UI-layer manipulation	runtime.environment
02	Transaction parameter tampering — modifying values between confirm and submit	data-layer manipulation	binding.status
03	Accessibility service abuse — automated UI scraping and input synthesis	OS-permission abuse	runtime.environment
04	Malicious input-method editor (IME) compromise	input-method compromise	runtime.environment
05	Snapshot timing — exploiting visible state during background transition	runtime timing	runtime.environment
06	The SDK 31–33 run-as vulnerability window	SDK 31–33 vulnerability window	code.integrity
07	Screen-capture attacks — MediaProjection abuse	screen-graph leakage	runtime.environment
08	Library injection via Frida and Xposed	dynamic instrumentation	code.integrity
09	Root cloaking — hiding root state from in-app checks	environment falsification	device.integrity
10	Hook-detection bypass and counter-detection	counter-detection	runtime.environment
11	Debugger attachment and runtime introspection	runtime introspection	runtime.environment
12	Magisk and Zygisk — rootkit-class module abuse	rootkit-class modules	code.integrity
13	Runtime memory manipulation — process-memory rewriting	memory rewriting	code.integrity
14	How advanced malware from Asia is targeting Africa's financial sector	regional threat intelligence	multi-class

how this theme is written

Each article documents an attack class as a technical phenomenon. The mechanism, the syscalls and APIs touched, the checkpoints (Play Integrity, App Attest, FIDO2, hardware attestation) bypassed, the observable signal class, the Evidence Token shape produced when the substrate sees the technique. We write so that an engineer who builds detection for these techniques would read the page and recognise their work — not as accusation, as documentation.

articles in this theme

type

depth

audience

← back to Knowledge Center theme 02 · checkpoint architectures → /architecture/threat-model →

Each attack is a technical phenomenon — documented, named, observable.

Overlay injection — system-overlay UI manipulation on Android

Transaction parameter tampering — modifying values between confirm and submit

Accessibility service abuse — automated UI scraping and input synthesis

Malicious input-method editor (IME) compromise

Snapshot timing — exploiting visible state during background transition

The SDK 31–33 run-as vulnerability window

Screen-capture attacks — MediaProjection abuse

Library injection via Frida and Xposed

Root cloaking — hiding root state from in-app checks

Hook-detection bypass and counter-detection

Debugger attachment and runtime introspection

Magisk and Zygisk — rootkit-class module abuse

Runtime memory manipulation — process-memory rewriting

How advanced malware from Asia is targeting Africa's financial sector