Understand the threat without becoming a victim of it

This is a defensive course. You learn to analyse suspicious mobile apps the way a SOC or threat-intel analyst does: identify what a sample does, extract indicators, and write it up so defenders can act. You are never asked to build or spread malware.

Why mobile is different

Sandboxed apps — malice usually hides in abused permissions and legitimate APIs, not memory corruption.
App stores & sideloading — Android sideloads APKs; iOS abuse rides config profiles / enterprise certs.
Persistence is subtle — accessibility services, device-admin, background jobs.

Safe-handling rules (always)

Work only on an isolated analysis device/VM, never your daily phone.
No real SIM, no personal accounts, airplane mode or a controlled network tap.
Treat every sample as live; label and store it encrypted.

🎯 Challenge: Why do we analyse mobile malware on an isolated device with no personal accounts, and name two abused-permission categories that signal malice?

Show solution

Isolation stops the sample exfiltrating real data, enrolling your accounts, or spreading — and gives a clean, repeatable baseline. High-signal permission abuse: Accessibility Service (read/automate the whole screen, overlay attacks) and SMS/Call access (OTP theft, premium-rate fraud). Others: device-admin, notification listener, "install unknown apps".

Liked it? 11 more lessons are waiting.

12 lessons · knowledge checks · final exam · verifiable certificate

Unlock all courses · CHF 9/month Buy only this course · CHF 19

What's in Mobile Malware Analysis

1. Mobile Malware Analysis & the Analyst MindsetFree
2. Mobile Malware Types & Families🔒 Foundations
3. Android APK Triage Workflow🔒 Android
4. Dropper & Loader Patterns🔒 Android
5. Command-and-Control Indicators🔒 Core
6. Static Triage: Manifest, DEX, Strings & YARA🔒 Static
7. Dynamic & Sandbox Behaviour Analysis🔒 Dynamic
8. Network IOC Extraction🔒 Core
9. iOS Malware & Configuration-Profile Abuse🔒 iOS
10. De-obfuscation Concepts🔒 Advanced
11. Writing the Analysis Report🔒 Reporting
12. Exam — Mobile Malware Analyst🔒 Exam

Continue in the interactive course reader →

Mobile Malware Analysis & the Analyst Mindset

Understand the threat without becoming a victim of it

Why mobile is different

Safe-handling rules (always)

Liked it? 11 more lessons are waiting.

What's in Mobile Malware Analysis