Mobile Malware · Detection & Defense · Lesson 5 of 5

Challenge: The Credit Union Alert

Handle a flagged employee phone from the first alert to a fixed flaw.

The alert

You're Jordan, a security engineer at a regional credit union. Staff use their own Android phones for work. Each phone has a work profile managed through MDM, an MTD app, and a conditional access rule that only lets compliant phones reach company email.

On Tuesday morning, the MTD console marks Sam's phone as high risk. Sam works in loans. The alert says an app with Accessibility access was installed from outside Google Play, and the phone's security patch level is 14 months old. Minutes later, Sam messages you that his work email has stopped syncing, though his personal apps are fine.

Your manager, Dana, asks you to open the MDM console, find out exactly which personal app it is, read Sam's personal texts to see how it got there, and wipe the whole phone if needed.

Credentials

Sam finds a "Loan Calculator Plus" app he installed from a link in a text message. He removes it using the steps you send him. The MTD app reports the phone as clean, and he asks to get his email back right away.

You know an app with Accessibility access may have seen everything on screen, including his work password and the one-time codes for the credit union's systems. Before access is restored, Sam's work password and sessions need resetting.

A flaw in a familiar app

Your colleague Riley analyzes the removed app's sample in the team's isolated lab. It turns out the malware abused a flaw in a widely used PDF viewer app to grab files without asking. The PDF viewer's developer runs a bug bounty program. No fix exists yet.

Riley is angry and wants to post a working proof of concept on social media today, so that "everyone knows how bad this is."

A different kind of alert

The following week, a credit union board member who also works as an investigative journalist calls you. She received an Apple threat notification on her iPhone and the matching email from Apple. She asks whether you can scan her phone with "that spyware checker" today and tell her it's clean.

You know the tool runs on an iPhone backup and compares records against published indicators. You also know what a no-match result can and can't prove, and that she needs specialists.