Investigating a CFO’s Compromised Phone: A Mobile DFIR Walkthrough
Summary
A mobile DFIR walkthrough uses fictional Android and iPhone incidents, informed by Censys ARC research, to show how responders can investigate malware, credential theft, and exploit infrastructure through endpoint, identity, and network telemetry.
Key points
- For a suspected malicious Android app, the article recommends blocking corporate access, revoking sessions, preserving the phone, collecting the APK and telemetry, and assessing potentially exposed credentials and MFA.
- ERMAC and HookBot can abuse Android accessibility permissions to overlay fake logins and steal credentials or codes; HookBot also supports remote control and file management.
- Historical infrastructure observations can reveal HookBot activity even when an IP no longer exposes its panel, including changes consistent with an allowlist security gate.
- For a suspected iPhone compromise, responders can correlate identity alerts with managed-device web logs to investigate a suspicious destination and the time a link was opened.
- The fictional iPhone scenario links a credential-harvesting page with DarkSword exploit infrastructure; the article says exploitation depends in part on whether the device was running a vulnerable iOS version.
- Pivoting on more durable infrastructure traits, such as a page-body hash, can reveal related hosts and support broader searches across organizational logs.
- The scenarios emphasize that an IOC is a starting point: responders should investigate its history, related infrastructure, and possible exposure across other users and devices.
Article Details
- Defense Focus
- Investigate suspected mobile compromise by correlating endpoint and identity alerts with mobile network telemetry and historical threat-infrastructure observations, then scope related infrastructure across the organization.
- Detection Methods
- Review mobile endpoint alerts and APK metadata, including installation source, path, timestamps, permissions, and threat metadata.
- Correlate the affected user's identity and device with outbound web transactions around the suspected compromise window.
- Use historical infrastructure observations and pivots across prior IPs, DNS resolutions, certificates, services, ports, HTTP bodies, and related assets.
- Search current and historical proxy, DNS, firewall, mobile, and SIEM telemetry for identified infrastructure and related domains.
- Hunt for durable infrastructure characteristics, including the DarkSword Admin page SHA-256 body hash and recurring HookBot builder characteristics.
- Data Sources
- Mobile endpoint alerts and APK metadata
- Mobile VPN logs
- Zscaler web and mobile logs, including user, device, URL or destination, and destination server IP
- Identity and session telemetry
- Proxy, DNS, firewall, and SIEM logs
- Historical Internet infrastructure observations, including threat labels, certificates, services, ports, DNS resolutions, and HTTP body hashes
- Rule Types
- Infrastructure-characteristic detections based on related hosts, domains, certificates, services, and HTTP body hashes
- Platforms
- Censys Adversary Investigation
- Censys Investigator
- Censys Collection
- Defensive Actions
- Block a compromised device from corporate resources and revoke its active sessions.
- Preserve the device and relevant evidence, including the APK, its hash, installation timestamp, and available network telemetry.
- Assess and reset potentially exposed corporate credentials; review password-manager, SMS-based MFA, banking, cryptocurrency, and Apple ID exposure as applicable.
- For suspected iPhone compromise, determine the iOS version at the time of contact; preserve the phone for mobile forensics before wiping or rebuilding it, and ensure its replacement runs a patched iOS version.
- Search historical logs for related infrastructure and other potentially affected devices, not just the initially observed IP.
- Feed relevant infrastructure characteristics and new observations into SOC monitoring and detection engineering.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ng28jt[.]xyz | Domain named in the TLS certificate of the host serving the Apple ID credential-harvesting page and DarkSword infrastructure. |
| IPV4 | 103[.]106[.]190[.]217 | DarkSword-cluster host observed serving an Apple ID credential-harvesting page alongside iOS exploit-chain staging infrastructure and a C2 Control Panel. |
| IPV4 | 118[.]107[.]45[.]29 | Censys observed this host carrying a HookBot threat label; the article describes it as infrastructure contacted by the infected Android device. |
| IPV4 | 156[.]234[.]84[.]242 | Previous IP identified through infrastructure investigation and presented as related infrastructure to search for in company logs. |
| IPV4 | 23[.]248[.]212[.]122 | Previous IP identified through infrastructure investigation and presented as related infrastructure to search for in company logs. |
People
Malware
DarkSwordCensys ARC observed this host as part of a DarkSword cluster.ERMACLet’s say the APK resembles one of the ERMAC or HookBot builds recently investigated by Censys ARC.GHOSTBLADEA successful chain ultimately deploys GHOSTBLADE modules capable of dumping keychain, iCloud, and Wi-Fi credentials and exfiltrating files.HookHook expanded the family further with capabilities for remote screen control, file management, and even WhatsApp manipulation.HookBotLet’s say the APK resembles one of the ERMAC or HookBot builds recently investigated by Censys ARC.
Vendors
CensysI’ve spent a lot of time lately writing about what Censys can do before an alert: detection engineering, threat hunting, and crunching Internet infrastructure into your own threat intelligence.MicrosoftIt is 9:12 AM and Microsoft Defender is calling.ZscalerThe device is supervised and managed through MDM, with Zscaler Client Connector deployed and enforced by IT.
Products
Censys Adversary InvestigationDrop it into Censys Adversary Investigation.Censys CollectionAdd relevant infrastructure to a Censys Collection, track the pattern, and feed new observations back into the SOC.Censys InvestigatorCensys Investigator can take indicators, inspect their history, analyze related assets, and return a report that preserves the evidence behind those relationships.Microsoft Defender for EndpointSource: Microsoft Defender for EndpointZscaler Client ConnectorThe device is supervised and managed through MDM, with Zscaler Client Connector deployed and enforced by IT.
Industries
BankingOf all the phones in the company, you got the one attached to banking apps, executive email, Slack, expense accounts, password resets, MFA prompts, travel plans, investor conversations, and a metric ton of other thingsCryptocurrencyWhen the victim opens a targeted banking or cryptocurrency app, the malware can place a fake login interface over the real one.