Banking Report 2025: Security at the Core of Mobile Finance(opens in a new tab)
Findings from more than 500 mobile banking apps: which protections are in place and where the gaps are. Includes a PDF report.
Research
Original security research from Ostorlab
Mobile and banking security studies, vulnerabilities we disclosed, what our AI agents found, and the open-source tools we maintain. Every item links to the full write-up or code, so your team can check the details.
Items shown: 26
Original research
Studies of mobile banking apps, vulnerabilities we found and reported, and threat research on banking malware.
Banking report series
Mobile banking security, studied over time
Two editions of our study of mobile banking apps. Read them together to see how protections and common weaknesses evolve.
Security Landscape of Mobile Banking Applications in North America(opens in a new tab)
The earlier edition, on banking apps in North America, for a point of comparison.
ZIP Exploitation: Critical Vulnerabilities in Popular Zip Libraries in Swift and Flutter(opens in a new tab)
Five CVEs in ZIP libraries used by iOS and Flutter apps: a dependency risk your own apps can inherit.
From Signal to the Android SDK: Chaining Path Traversal, Mimetype Confusion, Security Check Bypass(opens in a new tab)
A chain from Signal down to the Android SDK. Signal acknowledged the report in 3 hours and fixed it; no CVE was assigned.
Bypassing Mobile App Shielding: Where Detection Ends and Enforcement Fails(opens in a new tab)
Five production banking apps tested against four commercial shielding products, showing where detection works but enforcement does not.
Inside BeatBanker / BTMOB: Static Analysis of a Multi-Stage Android Banking Malware Platform(opens in a new tab)
Static analysis of a multi-stage Android banking malware platform, the kind of threat your customers' phones face.
One Scheme to Rule Them All: OAuth Account Takeover(opens in a new tab)
Custom URL scheme hijacking that leads to account takeover, a pattern that applies to mobile banking login flows.
zCamera, 100M+ installation app, from remote compromise to data leaks(opens in a new tab)
From remote compromise to data leaks in an app with more than 100 million installs.
AI agents at work
Vulnerabilities found by our AI engine during agentic penetration testing, in mobile apps first, then in the APIs behind them.
Javascript Interface Exposure(opens in a new tab)
Our AI engine found a WebView JavaScript bridge in an Android app that could be reached through deep links.
Going Beyond: Ostorlab AI Engine Discovers Unknown Vulnerability Classes(opens in a new tab)
The AI engine found vulnerability classes it was not told to look for, including a WebView Safe Browsing bypass.
AI-Powered Pentesting: A Deep Dive into Android Intent Redirection(opens in a new tab)
How the AI engine found an Android intent redirection and proved it with a working proof of concept.
AI Pentest Engine Discovers Critical WebSocket BFLA in GraphQL Subscriptions(opens in a new tab)
A broken access control in the GraphQL subscriptions of a backend API: the servers behind your mobile app.
AI Engine Triggers Account Takeover via API Version Confusion(opens in a new tab)
An account takeover through a password reset flow still exposed on an older API version.
Techniques
Practical write-ups for mobile security practitioners: obfuscation, instrumentation, reverse engineering and pinning.
Bypassing Obfuscation in Android Apps: DalvikFLIRT and LLM-Powered Rewrites(opens in a new tab)
How to recover readable code from obfuscated Android apps with signature matching and LLM rewrites.
Swift Under the Microscope: Practical Dynamic Instrumentation(opens in a new tab)
Hands-on dynamic instrumentation of Swift code in iOS apps.
Flutter Reverse Engineering and Security Analysis(opens in a new tab)
How to reverse engineer and assess apps built with Flutter.
Universal bypass of SSL Pinning, from theory to a full working PoC with LLDB(opens in a new tab)
A universal SSL pinning bypass with LLDB, from theory to a working proof of concept.
Application Security Testing on non-Jailbroken iOS from Linux(opens in a new tab)
Security testing of iOS apps on non-jailbroken devices, from a Linux workstation.
Mapping Dependency Confusion: A Novel Detection Approach using Source Map Files(opens in a new tab)
A detection approach for dependency confusion that uses source map files.
Benchmarks and test apps
Deliberately vulnerable apps and benchmarks you can run to evaluate any mobile security tool, including ours.
Introducing Ostorlab Security Testing Benchmarks: Real Vulnerabilities, Real Impact(opens in a new tab)
93 vulnerable mobile apps based on real CVEs and bug bounty findings, open for anyone to test tools against.
Repositories
Insecure Android and iOS apps
Deliberately vulnerable apps that anyone can run as test targets.
Ostorlab's Insecure Flutter Apps: A Playground for Learning and Testing Mobile Security(opens in a new tab)
Deliberately vulnerable Flutter apps for learning and for testing tools.
Open source
Tools we build and maintain in the open.
Ostorlab/oxo(opens in a new tab)
Our open-source security scanning orchestrator: more than 15,000 PyPI downloads a month and 113 releases in the last 12 months.
Ostorlab/KEV(opens in a new tab)
One command to detect known exploited vulnerabilities, using CISA KEV, Tsunami and Asteroid.
Ostorlab/agent_asteroid(opens in a new tab)
The remote vulnerability detection agent behind KEV.
CI integrations
Scan every release from GitHub Actions, Azure DevOps or GitLab CI.
Plus more than 30 open-source agents, including Nmap, ZAP, Nuclei, Tsunami, OpenVAS, Semgrep and TruffleHog.Browse the agents (opens in a new tab)
See what our research finds in your app
Ostorlab's agentic penetration testing builds on this research to test every release of your mobile app.