Mobile Malware · Real-World Cases · Lesson 5 of 5

Challenge: The Case Review

Match three company phone incidents to the cases you've studied.

Incident notes

You're a junior analyst on a company security team. Your manager hands you three open tickets and asks which documented cases they resemble, so the team knows what to check next.

• Ticket 1: Sam in sales got a text saying he had a new voicemail, with a link to install a player app. He installed it and turned on an accessibility setting it asked for. Now the carrier says his phone sent hundreds of texts in two days. Sam says most of the numbers aren't in his contacts at all.
• Ticket 2: Finance spotted small daily charges on several company phone bills, all from a premium service. Every affected phone has the same Play Store photo filter app, which updated last month.
• Ticket 3: An executive's iPhone has failed to install iOS updates for weeks. Wi-Fi monitoring shows short iMessage connections followed by large uploads to an unfamiliar server.

Start with Sam. A colleague says the strange numbers prove this can't be FluBot-like malware, because FluBot texted the victim's contacts.

The photo filter app

Your team installs the same photo filter app on a clean test phone with a SIM from a different country and watches it for a day. It applies filters and does nothing suspicious. A teammate wants to close Ticket 2 as "app is clean." You remember a technique Google described in Bread, where the app asks its server about the phone's mobile network before deciding how to behave.

The executive's iPhone

Ticket 3 reminds you of Operation Triangulation: a network clue first, then an iPhone that quietly refuses to update. Your manager asks for a sensible next step. The phone can't be browsed directly, the executive is traveling next week, and the team wants solid evidence before anyone touches the device or tells the executive what they suspect. Whatever you choose should keep the traces intact.

The briefing slide

Your manager also wants one slide on Operation Triangulation for the company's leadership, as background for Ticket 3. A draft from a colleague says: "Operation Triangulation was a US intelligence attack carried out with Apple's help, as proven by the FSB." Leadership will likely repeat whatever the slide says, so every claim needs to match what the sources actually published.