Mobile Malware · Cutting Off Malware · Lesson 2 of 5

Data Theft & Exfiltration

What malware carries off a phone, and the signs that data is leaving.

What gets taken, and how defenders name it

Once a malicious app is running, its value to the operators usually comes from what it can carry off the phone. Sending data off a device without the owner's permission is called exfiltration. Stolen data mostly falls into a few groups:

• Contacts, used to reach the next victims or sold as lists.
• SMS messages, including the one-time codes banks text you to confirm a login or payment.
• Credentials, the usernames and passwords people type, often captured with the fake login screens from Overlays & Banking Trojans.
• Photos and files, which can hold more than people expect: screenshots of passwords, ID cards, bank details.
• Device details, like the model and the list of installed apps, which tell the operators what to target.

FluBot shows stolen data doing double duty. According to Europol, as reported by The Hacker News, it accessed victims' contacts and texted them links to the malware. Every infected phone became a sender for the next wave. NCC Group's researchers also described it reporting the list of installed apps, so its operators knew which banking screens to show.

To describe all this consistently, defenders use MITRE ATT&CK for Mobile, a free public knowledge base at attack.mitre.org that names and numbers techniques seen in real attacks. It's a shared vocabulary, not a how-to. Entries that fit this module:

• Protected User Data (T1636), with sub-techniques for the contact list (T1636.003), SMS messages (T1636.004), call log, calendar and accounts.
• Input Capture (T1417), for grabbing what the user types or taps, including fake login screens.
• Data from Local System (T1533), for files and photos stored on the phone.
• The Exfiltration tactic (TA0036), which groups the ways data leaves a device.

MITRE's FluBot entry (S1067) maps it to both Contact List and SMS Messages, among others. When two teams both write T1636.003, they know they mean the same behavior, even if their reports use different words.

SparkCat and the signs people can notice

In February 2025, researchers at Kaspersky described SparkCat, malicious code hidden inside otherwise ordinary apps on both Google Play and Apple's App Store. One was a food delivery app called ComeCome. The malicious part asked for access to the photo gallery at a believable moment, when the user opened a support chat. It then scanned the photos for text using optical character recognition (OCR), the same technology that lets your phone copy text out of a picture.

It was hunting for recovery phrases for cryptocurrency wallets: the list of words that lets anyone restore a wallet and spend its funds. People often screenshot these to keep them safe. Matching images were sent off the phone. Kaspersky reported that the affected Android apps had been downloaded more than 242,000 times, and said this was the first time a stealer had been found in Apple's App Store. Kaspersky's report notes that Apple and Google removed the apps within days.

The lesson is that a photo gallery is a data store, and permission to read it matters. Signs that data may be leaving a phone include:

• An app asking for photo, contact or SMS access that its job doesn't explain, or asking at an odd moment.
• Friends reporting strange texts from your number, which is how many FluBot victims found out.
• One-time codes or login alerts you didn't trigger.
• Higher data use or battery drain from one app, visible in Settings. This is a weak sign on its own.
• For companies, network logs showing an upload to an unfamiliar domain soon after an app was installed.

Kaspersky's advice was practical: uninstall the affected apps, treat any recovery phrase stored as a screenshot as exposed and move the funds to a new wallet, and keep secrets in a password manager rather than the gallery. On iPhone and recent Android versions you can also grant an app access to selected photos instead of the whole library, which limits what any app can read.

For perspective, cases like this are found and removed regularly, but they reach a small share of users. Careful permissions protect against most of them.