Mobile Banking App Security Report 2025
Findings from more than 500 mobile banking apps: which protections are in place and where the gaps are. Includes a PDF report.
Research
Original security research from Ostorlab
Mobile and banking security studies, vulnerabilities we disclosed, what our AI agents found, and the open-source tools we maintain. Every item links to the full write-up or code, so your team can check the details.
Items shown: 38
Original research
Studies of mobile banking apps, vulnerabilities we found and reported, and threat research on banking malware.
Banking report series
Mobile banking security, studied over time
Two editions of our study of mobile banking apps. Read them together to see how protections and common weaknesses evolve.
Security Landscape of Mobile Banking Applications in North America(opens in a new tab)
The earlier edition, on banking apps in North America, for a point of comparison.
llama.cpp: Denial of Service via Oversized recv_msg Length in ggml-rpc Server(opens in a new tab)
Uncaught std::length_error exception in ggml-rpc's recv_msg() terminates the server process via std::terminate when an oversized message length header exceeding vector max_size() is received.
CVE records
llama.cpp: Stack-Based Buffer Overflow in ggml-rpc RDMA rdma_recv(opens in a new tab)
Stack-based buffer overflow in ggml-rpc's RDMA transport allows unauthenticated remote attackers to achieve code execution or denial of service via oversized verbs work completions in rdma_recv().
CVE records
Assimp: Heap Out-of-Bounds Read via MD2 Importer Integer Overflow(opens in a new tab)
Integer overflow in Assimp's MD2Importer::ValidateHeader() allows attackers to bypass frame table bounds checks via crafted numFrames and numVertices values, causing a heap out-of-bounds read.
CVE records
LibreSSL: CRLF Injection, Cleartext Transmission, and Memory Exhaustion in OCSP(opens in a new tab)
Four CVEs identified in LibreSSL covering CRLF injection in libcrypto and ocspcheck, cleartext transmission of OCSP requests over unencrypted HTTP, and memory exhaustion from unbounded responder responses.
OpenImageIO: Cineon Reader Heap Out-of-Bounds Read(opens in a new tab)
Integer wraparound identified in OpenImageIO's Cineon codec scanline allocation, resulting in heap under-allocation and an out-of-bounds read during decompression.
CVE records
VLC for Android: Confused-Deputy File Overwrite via Spoofed Mail Attachment Provider(opens in a new tab)
Confused-deputy file overwrite in VLC for Android: a zero-permission app can spoof the K-9 Mail attachment provider and make VLC overwrite files in the shared Download folder when VLC holds All files access.
CVE records
Chatwoot: Stored XSS via Help Center Video Embed Links(opens in a new tab)
Stored XSS in Chatwoot's Help Center video embed rendering: angle-bracket link destinations with double quotes break out of the unescaped iframe src in render_embed_from_match, running script for public visitors and exposing widget tokens.
CVE records
HarfBuzz: Out-of-Bounds Write and DoS in WebAssembly Shaper(opens in a new tab)
Two CVEs identified in HarfBuzz covering an out-of-bounds write and a NULL pointer dereference DoS in the WebAssembly shaper.
Keycloak: Stored XSS on the Login Page via kcSanitize Bypass(opens in a new tab)
Stored XSS identified in Keycloak's login theme rendering: the fixURLs() post-processor re-activates character references neutralized by kcSanitize, running script on the pre-authentication login page for every user of the realm.
CVE records
Poppler: Stack-Based Buffer Overflow in Decrypt::revision6Hash(opens in a new tab)
Stack-based buffer overflow identified in Poppler's Decrypt::revision6Hash, allowing memory corruption when opening AESV3/R6 encrypted PDFs.
CVE records
Breaking Down GoPhish: Source-Code Assessment with Ostorlab Agentic Deep Scan(opens in a new tab)
Five CVEs identified in GoPhish across SSRF, XSS, rate-limit bypass, and object takeover using Ostorlab Agentic Deep Scan.
ZIP Exploitation: Critical Vulnerabilities in Popular Zip Libraries in Swift and Flutter(opens in a new tab)
Five CVEs in ZIP libraries used by iOS and Flutter apps: a dependency risk your own apps can inherit.
From Signal to the Android SDK: Chaining Path Traversal, Mimetype Confusion, Security Check Bypass(opens in a new tab)
A chain from Signal down to the Android SDK. Signal acknowledged the report in 3 hours and fixed it; no CVE was assigned.
Bypassing Mobile App Shielding: Where Detection Ends and Enforcement Fails(opens in a new tab)
Five production banking apps tested against four commercial shielding products, showing where detection works but enforcement does not.
Inside BeatBanker / BTMOB: Static Analysis of a Multi-Stage Android Banking Malware Platform(opens in a new tab)
Static analysis of a multi-stage Android banking malware platform, the kind of threat your customers' phones face.
One Scheme to Rule Them All: OAuth Account Takeover(opens in a new tab)
Custom URL scheme hijacking that leads to account takeover, a pattern that applies to mobile banking login flows.
zCamera, 100M+ installation app, from remote compromise to data leaks(opens in a new tab)
From remote compromise to data leaks in an app with more than 100 million installs.
AI agents at work
Vulnerabilities found by our AI engine during agentic penetration testing, in mobile apps first, then in the APIs behind them.
Javascript Interface Exposure(opens in a new tab)
Our AI engine found a WebView JavaScript bridge in an Android app that could be reached through deep links.
Going Beyond: Ostorlab AI Engine Discovers Unknown Vulnerability Classes(opens in a new tab)
The AI engine found vulnerability classes it was not told to look for, including a WebView Safe Browsing bypass.
AI-Powered Pentesting: A Deep Dive into Android Intent Redirection(opens in a new tab)
How the AI engine found an Android intent redirection and proved it with a working proof of concept.
AI Pentest Engine Discovers Critical WebSocket BFLA in GraphQL Subscriptions(opens in a new tab)
A broken access control in the GraphQL subscriptions of a backend API: the servers behind your mobile app.
AI Engine Triggers Account Takeover via API Version Confusion(opens in a new tab)
An account takeover through a password reset flow still exposed on an older API version.
Techniques
Practical write-ups for mobile security practitioners: obfuscation, instrumentation, reverse engineering and pinning.
Bypassing Obfuscation in Android Apps: DalvikFLIRT and LLM-Powered Rewrites(opens in a new tab)
How to recover readable code from obfuscated Android apps with signature matching and LLM rewrites.
Swift Under the Microscope: Practical Dynamic Instrumentation(opens in a new tab)
Hands-on dynamic instrumentation of Swift code in iOS apps.
Flutter Reverse Engineering and Security Analysis(opens in a new tab)
How to reverse engineer and assess apps built with Flutter.
Universal bypass of SSL Pinning, from theory to a full working PoC with LLDB(opens in a new tab)
A universal SSL pinning bypass with LLDB, from theory to a working proof of concept.
Application Security Testing on non-Jailbroken iOS from Linux(opens in a new tab)
Security testing of iOS apps on non-jailbroken devices, from a Linux workstation.
Mapping Dependency Confusion: A Novel Detection Approach using Source Map Files(opens in a new tab)
A detection approach for dependency confusion that uses source map files.
Benchmarks and test apps
Neutron’s verified exploitation results on UC Berkeley’s CyberGym, alongside open benchmarks and deliberately vulnerable apps your team can use to evaluate security tools.
Ostorlab Neutron on UC Berkeley CyberGym(opens in a new tab)
Neutron achieved 97.1% verified exploitation on UC Berkeley’s CyberGym: 1,463 of 1,507 tasks involving known vulnerabilities in open-source C/C++ projects. Read our technical write-up for the run setup, methodology and results.
Introducing Ostorlab Security Testing Benchmarks: Real Vulnerabilities, Real Impact(opens in a new tab)
An open test dataset of 93 vulnerable mobile apps based on real CVEs and bug bounty findings. Use these reproducible targets to evaluate mobile security tools.
Repositories
Insecure Android and iOS apps
Deliberately vulnerable apps that anyone can run as test targets.
Ostorlab's Insecure Flutter Apps: A Playground for Learning and Testing Mobile Security(opens in a new tab)
Deliberately vulnerable Flutter apps for learning and for testing tools.
Open source
Tools we build and maintain in the open.
Ostorlab/oxo(opens in a new tab)
Our open-source security scanning orchestrator: more than 15,000 PyPI downloads a month and 113 releases in the last 12 months.
Ostorlab/KEV(opens in a new tab)
One command to detect known exploited vulnerabilities, using CISA KEV, Tsunami and Asteroid.
Ostorlab/agent_asteroid(opens in a new tab)
The remote vulnerability detection agent behind KEV.
CI integrations
Scan every release from GitHub Actions, Azure DevOps or GitLab CI.
Plus more than 30 open-source agents, including Nmap, ZAP, Nuclei, Tsunami, OpenVAS, Semgrep and TruffleHog.Browse the agents (opens in a new tab)
See what our research finds in your app
Ostorlab's agentic penetration testing builds on this research to test every release of your mobile app.