ETCISO reports AI is accelerating mobile fraud, credential theft and malware

What happened

ETCISO published an article on 2026-10-27 under a TechGig byline. According to ETCISO, artificial intelligence and large language models are making fraud attacks against mobile applications faster, cheaper and more efficient (ETCISO).

This is a trend piece. It does not describe a single incident or a single vulnerability. The article cites figures from several organisations but does not link to the underlying reports, and those figures have not been independently verified.

According to ETCISO, the cited claims include:

• Fraud economics: INTERPOL reported that AI-enabled fraud attacks are about 4.5 times more profitable than attacks without AI (ETCISO).
• Contact channels: Initial contact for fraud via SMS and text grew by 35 per cent since September 2025, while email approaches fell by 30 per cent (ETCISO).
• Click rates: Verizon’s phishing simulation research found that the median click rate for voice and text vectors is 40 per cent higher than for email (ETCISO).
• Credential theft: Credential theft attempts rose by 78 per cent in early 2026 (ETCISO).
• Developer survey: 81 per cent of surveyed mobile app developers said AI-generated code introduces new vulnerabilities. More than half admitted shipping code they knew was vulnerable because of deadlines. The article does not name the survey source (ETCISO).
• Hardcoded secrets: Anthropic discovered a credential-harvesting pipeline that exploited Claude AI. In that pipeline, attackers downloaded and decompiled 1.8 million Android APKs to scan for hardcoded secrets (ETCISO).
• Reverse engineering tools: The article says attackers use tools such as JEB, Ghidra and Frida for AI-assisted reverse engineering (ETCISO).
• Phishing automation: The article says LLM-automated phishing campaigns cut costs by over 95 per cent (ETCISO).
• Malware built with AI help: According to the article, RemControl, NGate and Canis C2 show evidence of AI coding assistant involvement (ETCISO).
• Malware with built-in AI: According to the article, several variants incorporate AI or LLM functionality (ETCISO):
  • SURXRAT conditionally downloads an LLM module.
  • PromptSpy uses Gemini for context-aware user interface manipulation.
  • RatHat uses one model to rank victims by bank balance and an LLM to maintain automation on the device.
• State-linked group: The article describes GTG-20006 as a Russian state-sponsored group. It says the group uses AI to rebuild malware after detection, with a toolkit that includes GiftDrop for Android and DarkSword for iOS. This attribution comes only from the article and is not independently confirmed (ETCISO).
• Deepfakes: The article says deepfake spoofing of KYC identity checks rose 83 per cent year over year. It also says deepfakes made up one in five biometric fraud attempts in 2026, with an estimated average cost of $680,000 per incident (ETCISO).
• API attacks: The article reports that daily attacks on mobile APIs rose 113 per cent over the last year, and links this increase to agentic AI (ETCISO).

The article names no CVEs, affected app versions or specific victims.

Am I affected?

There is no specific product or version to check. Based on what ETCISO describes, the article is most relevant to these groups:

• Teams with hardcoded API keys, tokens or other secrets in Android or iOS builds. The reported APK harvesting pipeline scanned specifically for hardcoded secrets (ETCISO).
• Backends with mobile APIs that do not verify that calls come from legitimate apps. The article reports rising automated bot attacks on mobile APIs (ETCISO).
• Services that rely on image-based or biometric KYC identity checks. The article reports rising deepfake spoofing of these checks (ETCISO).

Whether any particular app or organisation was targeted is not confirmed.

What to do now

The steps below reflect the defensive measures described in the ETCISO article (ETCISO).

1. Remove secrets from your app. Run continuous mobile app security testing (MAST) aligned with OWASP guidelines, so you find and remove secrets and hardcoded keys during coding.
2. Harden released builds. Apply multilayered code hardening such as obfuscation and encryption, and add code-embedded runtime checks to stop dynamic tampering. The article also describes polymorphic protections that change across builds and releases.
3. Verify the app calling your API. Use app attestation so that only legitimate apps in trusted environments can access your server-side resources.
4. Monitor API traffic. Add real-time threat monitoring to expose broader patterns of threat activity.

Sources

• ETCISO: AI accelerates mobile fraud, increasing credential theft and malware