MobileBOT™ Defense Threat Signals Reference Guide
This reference guide lists the Threat Signals available in MobileBOT™ Defense and the corresponding Threat-Event ExternalIDs they emit. Each selected Threat Signal adds its associated ExternalID to the Anti-Bot payload, allowing your backend services to identify detected threats and implement risk-based security and fraud prevention workflows.
The Threat Signals are organized by the categories displayed in the On-Device Bot Detection drawer to help you quickly locate the corresponding signal for each protection.
Security
|
Protection |
Signal (ExternalID) | Protection Description | Learn More |
|---|---|---|---|
|
Root Detection (Android)
|
RootedDevice
|
Identifies a rooted Android device with elevated privileges bypassing security restrictions.
|
How to Build Root Detection in Android Apps Using AI |
|
Jailbreak Detection (iOS)
|
JailbrokenDevice
|
An iOS jailbreak removes Apple’s restrictions, granting root access to the file system.
|
|
|
Detect Unknown Sources
|
UnknownSourcesEnabled
|
Allows installs from third-party stores, sideloaded APKs, or direct downloads outside trusted marketplaces.
|
|
|
MiTM Attack
|
SslCertificateValidationFailed
|
Intercepts and potentially alters communication between the app and its backend.
|
|
|
TLS Version
|
SslIncompatibleVersion
|
Enforces network connections to conform to TLS 1.2 or higher.
|
|
|
Proxy
|
NetworkProxyConfigured
|
Deep inspection of proxies and proxifying techniques including header manipulation and redirects.
|
|
|
Certificate Roles
|
SslInvalidCertificateChain
|
Enforces verification of the basicConstraints extension in the certificate chain.
|
|
|
Strong RSA Signature
|
SslInvalidMinRSASignature
|
Enforces server certificate signatures to use an RSA key of at least 2048 bits.
|
|
|
Strong ECC Signature
|
SslInvalidMinECCSignature
|
Enforces server certificate signatures to use an ECC key of at least 256 bits.
|
|
|
SHA256 Digest
|
SslInvalidMinDigest
|
Enforces at least a SHA256 certificate hashing algorithm.
|
|
|
Emulators
|
EmulatorFound
|
Detects emulators. Cannot be disabled; DEVICETrust™ method configurable.
|
Anti – Malware
|
Protection
|
Signal (ExternalID)
|
Protection Description |
Learn More
|
|
Hooking Frameworks
|
HookFrameworkDetected
|
Detects and prevents malicious runtime hooking that alters app behavior.
|
|
|
Detect Magisk (Android)
|
MagiskManagerDetected
|
Identifies and blocks Magisk, a systemless root tool that avoids detection.
|
|
|
Frida Tool
|
FridaDetected
|
Detects and blocks Frida toolkits that inject scripts at runtime.
|
|
|
StrongR Frida / Anti Frida Bypass
|
FridaCustomDetected
|
Detects non-official Frida builds that modify identifiers to avoid detection. [Confirm distinct vs shared ID]
|
|
|
RCE Attack
|
InjectedShellCodeDetected
|
Detects remote code execution attacks exploiting app vulnerabilities.
|
|
|
Detect SSL Pinning Bypass
|
SslIntegrityCheckFail
|
Protects against attacks that bypass certificate validation.
|
|
|
Detect Unlocked Bootloader
|
DetectUnlockedBootloader
|
Identifies custom ROM or unlocked bootloader granting system access.
|
|
|
Detect AndroidKernelPatch
|
KernelPatchDetected
|
Detects exploits modifying the Android kernel to bypass controls.
|
|
|
Detect KernelSU
|
KernelSUDetected
|
Detects the KernelSU superuser framework granting kernel root access.
|
|
|
OS Remount
|
OsRemountDetected
|
Detects filesystem-privilege modifications used to hide illegal activity.
|
|
|
Dirty Stream Attack (Android)
|
VulnerableUriDetected
|
Sanitizes URIs to prevent path traversal and unauthorized file access.
|
|
|
Detect AI-Assistant (Android)
|
UnauthorizedAIAssistantDetected
|
Detects active AI assistants with screen-access permissions.
|
|
|
Swizzling (iOS)
|
MethodSwizzlingDetected
|
Detects and prevents malicious Objective-C method swizzling.
|
|
|
Jailbreak Detection Bypass (iOS)
|
JailbreakBypassDetected
|
Detects jailbreak-bypass frameworks (Liberty Lite, A-Bypass, Hestia, tsProtector).
|
|
|
Detect Malware Injection
|
MalwareInjectionDetected
|
Detects malicious code embedded into legitimate apps.
|
|
|
Tricky Store (Android)
|
TrickyStoreDetected
|
Detects modifications to Android keystore attestation. (plugin DETECT_TRICKY_STORE)
|
Anti – Malware
|
Protection
|
Signal (ExternalID)
|
Protection Description |
Learn More
|
|
Detect Auto-Clickers
|
ClickBotDetected
|
Detects automated click bots and non-human input patterns.
|
|
|
Auto-Clickers Permissions
|
ClickBotDetectedByPermissions
|
Detects permissions that let any app generate automated clicks.
|
|
|
Keystroke Injection
|
KeyInjectionDetected
|
Detects keystroke injection via ADB and other methods.
|
|
|
Second Space & Parallel App
|
BlockSecondSpace
|
Prevents the app running in a second space / parallel instance.
|
|
|
Virtual Space
|
RunningInVirtualSpace
|
Detects and prevents the app running in a virtualized environment.
|
|
|
Seccomp
|
SeccompDetected
|
Detects Seccomp use from external processes interacting with the app.
|
|
|
Arm-in-arm Virtual Devices
|
CorelliumFileFound
|
Prevents the app running on arm-in-arm virtual devices.
|
|
|
Google Play Signature
|
NotInstalledFromOfficialStore
|
Validates that store-signed apps cannot be distributed through other stores.
|
|
|
GameGuardian
|
GameGuardianDetected
|
Detects and prevents the GameGuardian cheat engine.
|
|
|
Android Players
|
AppPlayerDetected
|
Blocks app players such as Nox and Memu. [Confirm Android emission]
|
|
|
Speed Hack
|
SpeedHackDetected
|
Detects modification of clock/sleep time for game cheating.
|
|
|
Code Injection Attack
|
CodeInjectionDetected
|
Detects code-injection libraries such as MobileSubstrate.
|
|
|
App-Specific Android Binding
|
AppBindingManipulation
|
Binds binaries/code flows to protect sensitive components. (Formerly AppIntegrityError; renamed R-202.)
|
|
|
Bundle Validation
|
RuntimeBundleValidationViolation
|
Checksum validation of every file in the app bundle.
|
|
|
APK Modding Tool
|
OatIntegrityBadCommandLine
|
Detects Android modding tools (Lucky Patcher, APK Editor, Freedom). (“Value Missing,” plugin OAT_INTEGRITY.)
|
|
|
Unity Cheats
|
UnityCheatDetect
|
Detects IL2CPP game cheats via runtime memory tampering. (plugin UNITY_CHEAT_DETECT)
|
|
|
Detect ClickFraud
|
ClickFraudDetected
|
Detects fraudulent/automated clicks using accessibility services. (plugin DETECT_CLICK_FRAUD)
|
Anti – ATO
|
Protection
|
Signal (ExternalID)
|
Protection Description |
KB Link
|
|
Face ID Bypass
|
FaceIDBypassDetected
|
Detects attempts to bypass native biometric / facial-recognition auth.
|
|
|
Deepfake Apps
|
VirtualCameraDetected
|
Identifies and blocks deepfake apps streaming AI video through virtual cameras.
|
How to Detect Deepfake Apps in Android and iOS |
|
Virtual Camera Substitution
|
VirtualCameraDetected
|
Detects virtual camera substitution. [Confirm distinct vs shared ID with Deepfake Apps]
|
|
|
Vishing
|
ActivePhoneCallDetected
|
Detects app use during/after an active call.
|
How to Detect Vishing Attacks Against Android & iOS Apps using AI |
|
Screen Sharing Scams & Malware
|
BlockedScreenCaptureEvent
|
Prevents screenshots, mirroring, screen sharing; hides preview thumbnails.
|
|
|
Remote Desktop Scam
|
IllegalDisplayEvent
|
Detects third-party apps attempting to remotely control the app.
|
How to Detect Remote Desktop Scams in Android Apps Using AI |
|
Malicious Remote Click
|
ClickBotDetectedVirtualFinger
|
Detects virtual touch inputs simulating user interaction.
|
How To Detect Malicious Remote Click in Android Apps Using AI |
|
Keylogging
|
BlockedKeyboardEvent
|
Enforces trusted keyboards to stop keystroke exfiltration.
|
|
|
Overlay Attacks
|
OverlayDetected
|
Detects and prevents screen overlays on top of the app.
|
How to Protect Mobile Apps from Overlay Attacks & Malware Using AI |
|
SIM Swap
|
SimStateInfo
|
Monitors SIM identifier changes (IMSI/ICCID) to detect SIM-swap events.
|
|
|
Memory Editing Tools
|
ActiveDebuggerThreatDetected
|
Detects advanced debuggers using memory tracing at runtime.
|
|
|
Clipboard Hijacking
|
BlockedClipboardEvent
|
Safeguards against unauthorized clipboard access.
|
How to Detect Clipboard Hijacking in Android Apps Using AI |
|
DeepSeek Attack
|
DeepSeekDetected
|
Detects DeepSeek use to protect against AI spyware exfiltration.
|
|
|
Bank Trojan Apps
|
BlockedATSModification
|
Detects and closes the app on a banking-trojan threat.
|
How to Detect Banking Trojan Apps Using Appdome |
|
Spyware (Stalker)
|
StalkerSpywareDetected
|
Detects stalker spyware monitoring app activity stealthily.
|
How to Detect Stalker Spyware in Android Apps |
|
GoldPickaxe (iOS)
|
InstalledMDMProfileDetected
|
Monitors MDM profiles to detect Gold Pickaxe malware installation stages. (DETECT_MDM)
|
How to Detect GoldPickaxe in iOS Apps Using AI |
|
Deepfake Video Detection
|
DeepfakeVideoDetection
|
Detects deepfake videos in real time. (plugin DETECT_STREAM_REPLAY)
|
|
|
Detect Video Injection Attack
|
VideoInjectionDetected
|
Sub-toggle of Deepfake Video Detection. (plugin DETECT_VIDEO_INJECTION)
|
How to Detect Video Injection Attacks in Android Apps Using AI |
|
Detect DMA Attacks
|
VideoDMADetected
|
Detects direct memory access attacks. (plugin DETECT_VIDEO_METADATA)
|
How to Detect Direct Memory Access (DMA) Attacks in Android Apps Using AI |
|
Adversarial Embedding Attack
|
AdversarialEmbeddingDetected
|
Monitors face embeddings for modification/manipulation/removal. (plugin DETECT_ADVERSARIAL_EMBEDDING)
|
How to Detect Adversarial Embedding Attacks in Android Apps Using AI |
|
Liveness Bypass
|
DetectLivenessBypass
|
Detects fake or replayed data tricking liveness checks. (plugin DETECT_LIVENESS_BYPASS)
|
How to Detect Liveness Bypass in Android Apps Using AI |
|
iOS Memory Dump
|
MemdumpDetected
|
Detects memory/binary dumps to prevent data extraction. (plugin ANTI_MEMDUMP)
|
How to Detect iOS Memory Dumps Using AI |
|
Android Memory Dump
|
MemdumpDetected
|
Detects memory/binary dumps to prevent data extraction. (plugin ANTI_MEMDUMP)
|
How to Detect Android Memory Dumps Using AI |
|
Prevent Bluetooth Scam
|
ExternalInputDeviceDetected
|
Detects app control via external input devices. (plugin DETECT_EXTERNAL_INPUT_DEVICE)
|
How to Prevent Bluetooth Scam in Android apps using AI |
|
Mobile Remote Access Trojan
|
OatIntegrityBadCommandLine
|
Detects mobile RAT infiltration attempts. (“unknown at this time,” plugin ANTI_AS_MALWARE.)
|
How to Detect Mobile Remote Access Trojans in Android Apps |
|
Android Device Admin Malware
|
RogueMDMChangeDetected
|
Detects malicious/unauthorized device-admin apps. (plugin DETECT_MDM)
|
How to Detect Android Device Admin Malware in Android Apps Using AI |
Geo Compliance
|
Protection
|
Signal (ExternalID)
|
Protection Description |
Learn More
|
|
Fake Location
|
GeoLocationSpoofingDetected
|
Detects device-level geolocation modification or interference.
|
|
|
Fake GPS App
|
GeoLocationMockByAppDetected
|
Detects use of a fake GPS app to report a false location.
|
|
|
VPN
|
ActiveVpnDetected
|
Detects VPN use spoofing device IP/location.
|
How to Detect VPNs Used With Android & iOS Apps Using AI |
|
No SIM Present
|
NoSimPresent
|
Detects a missing SIM card in the device.
|
How to Check for Missing SIM Cards on Android & iOS Devices Using AI |
|
Teleportation
|
TeleportationDetected
|
Detects unrealistic location jumps from spoofed inputs.
|
How to Detect Teleportation in Mobile Apps Using AI |
|
Geo DeSync
|
FraudulentLocationDetected
|
Ensures OS-reported location reflects actual whereabouts.
|
How to Detect Geo DeSync in mobile Apps Using AI |
MobileBOT™ Defense (MBD-level)
|
Protection
|
Signal (ExternalID)
|
Protection Description |
KB Link
|
|
App- Shielding
|
AppIntegrityError
|
Detects permanent application code changes.
|
|
|
Anti-Debugging
|
DebuggerThreatDetected
|
Detects native and Java debugging attempts.
|
How to Protect Android & iOS Apps with Anti-Debugging Protection |
|
Prevent Running on Emulators
|
EmulatorFound
|
Detects emulators and includes a signal in the anti-bot payload.
|
How to Detect Emulators in Android Apps Using AI |
|
Rate-Limit User Notification
|
MobileBotDefenseRateLimitReached
|
Limits connection requests per client to the host per timeframe.
|
How to Enforce Rate Limiting in MobileBOT™ Defense Using AI |
|
Pin to Host User Notification
|
MobileBotDefensePinToHostCertificatePinningFailed
|
Validates the server certificate (WAF-side) before connecting.
|
How to Secure Mobile Apps with Pin to Host Using AI |
Related Articles
- How to Protect Mobile Apps With Threat Signals Using AI
- How to Use Appdome MobileBOT™ Defense
- How to Use Appdome AppID™ In MobileBOT™ Defense
How Do I Learn More?
If you have any questions, please send them our way at support.appdome.com or via the chat window on the Appdome platform.
Thank you!
Thanks for visiting Appdome! Our mission is to secure every app on the planet by making mobile app security easy. We hope we’re living up to the mission with your project.
