As with any application, scanning code for security issues is part of good developer hygiene. The earlier a defect is identified, the easier and cheaper it is to fix it, namely because the context of how the code was built is still fresh in the developer’s mind (a principle known as Boehm’s Curve).

But mobile applications have some unique risks that differentiate them from common web apps and SaaS. Once a mobile app is released into the wild, it can be installed on jailbroken/rooted devices or launched in an emulator. The binary can be decompiled, tampered, reverse-engineered, and/or cloned. The mobile APIs that connect client-side apps to backend resources can be directly attacked by bots and scripts to access user accounts.

While mobile application security testing (MAST) is still essential for identifying weaknesses like insecure coding practices, hardcoded credentials, and other issues that could lead to an incident, it’s only the first step in the security process for a mobile app developer.

Weaponized AI Changes Protection Needs

In heavily regulated industries, mobile apps may need robust code protections in place in order to pass mandatory pentests before release. But once a mobile app is available for download from app stores around the world, that’s when protection meets real-world attack exposure. Because of their open exposure, unprotected mobile apps are susceptible to reverse engineering and tampering by malicious actors.

To make matters worse, the latest AI- and LLM-based tools are lowering the bar for “baby hackers” learning their craft, while helping experienced attackers amplify, iterate, and automate more sophisticated campaigns. Recent mobile malware variants offer several concrete examples. NGate and Canis C2 show evidence of being built with the assistance of AI. SURXRAT conditionally downloads an LLM module to expand its capabilities. PromptSpy incorporates Google’s Gemini chatbot for context-aware UI manipulation. AI is also playing a significant role in mobile app threats for:

• Stealing hardcoded secrets/credentials
• Phishing at scale
• Synthetic identity fraud

On the positive side, AI and LLMs are not independent creative forces on their own. They bring speed and scalability to an attack, but they don’t do anything all that new. The impact of weaponized AI will overwhelmingly be felt by mobile app developers that are getting by with outdated approaches to security: OS-only protections, DIY “vibe-coded” security, and single-layer “wrapper” or hybrid security products.

Evil Twins, Bad Bots, and Rogue Agents

Mobile APIs connect a mobile application to backend services, and a rising number of bad actors are directly targeting APIs to take over accounts and perpetrate fraud. This can happen in a few different ways:

Cloned Apps: Apps that have been reverse-engineered, modified, and repackaged to look and act like a genuine app can be used for a variety of nefarious end goals. Unlike a fake app that only has the appearance of a legitimate app (usually to steal a user’s login credentials or spread malware), a functional clone is a non-genuine replica that functions like the real deal. If the API allows a clone to connect to backend services, it can cause real problems. From bypassing paywalls to mobile gaming cheats to the proverbial 31 flavors of fraud.

Malicious bots, agents, and scripts: But the bad guys don’t even need a reversed client-side app to cause problems. The app’s backend also needs to determine whether requests are coming from a legitimate mobile application running in a trustworthy environment. With the right information gained from analyzing an app, an attacker can write a script to send a request directly to a mobile API to access the app’s server-side. Automated bots are another rampant API security issue. Nearly half of all advanced bot activity today is specifically targeted at APIs. AI agents are adding all sorts of novel security issues for mobile apps, including mobile API scraping.

Changing the Shape of Modern Protection

Any mobile apps that handle sensitive transactions or functions (e.g., banking, medical device controls, embedded payments) should not rely on a single defensive mechanism. If protection looks the same for every release in a developer’s portfolio, a single successful reverse engineering attack could become widely scalable across all the other applications using that protection.

Preventing this kind of worst-case scenario of a weaponized AI attack requires modern protection that 1) combines multiple defensive layers such as code transformation, data encryption, control-flow changes, runtime checks, and API security; and that 2) changes the shape of its protections across builds, applications, and releases. This essential second requirement is known as polymorphism.

Polymorphic protections prevent attackers from relying on a single, reusable playbook. With each new mobile app build, attackers are given a completely different set and configuration of security obstacles. The ever-changing shape of protections effectively “resets the clock” on reverse engineering attempts. As AI- and LLM-based tools help accelerate and automate attacks, polymorphism becomes a force multiplier for protecting mobile apps.

Polymorphism is made possible through compiler-based mobile app security tools. A compiler-based security approach provides the ability to generate unique security controls with each application build. These deeply integrated protections are automatically randomized in terms of semantics, locations, and structure.

Security across the Mobile App Lifecycle

After “shifting left” with continuous MAST in the development pipeline, organizations next need to think about the security needs of their apps post-release in an increasingly hostile environment. The same tools that help mobile app developers meet accelerated delivery goals and iterate new products and features give mobile app attackers their own advantages.

Organizations need to think holistically about how their mobile applications are secured throughout their entire lifespan. This should include:

• Multilayered code hardening and runtime checks (RASP) to prevent reverse engineering and tampering; these protections should also be polymorphic to reset the clock and prevent attacks at scale.
• API security in the form of dedicated app attestation capabilities that protect backend services from non-genuine calls to mobile APIs.
• The addition of real-time threat monitoring for emerging threat visibility and to inform adjustments to app attestation policies on-the-fly – instant updates to protection without the need to release a new version of your mobile app.

Clearly, shifting left is still essential, but it’s the opening move, not the whole game. Mobile apps are exposed the moment they hit an app store, and AI-based tools are only accelerating the attacks against them. Layered, polymorphic protections, mobile API security, and real-time monitoring continuously change the shape of your defenses to stay ahead of attackers today and prevent a reusable playbook tomorrow.