Appdome, the leader in protecting mobile businesses, today announced it is strengthening its Account Takeover Protection suite with 32 new AI-Native dynamic defense plugins that provide Mobile Account Protection to the new frontline of Account Takeovers (ATOs) and On-Device Fraud (ODF).
The new plugins are designed to help mobile brands and businesses maintain trust in the mobile experience and combat increasingly sophisticated malware that targets user identity, account creation, and transactions in mCommerce and other applications. Like all Appdome AI-Native defenses, each of the 32 new dynamic defense plugins for Mobile Account Protection is available by choice using the Appdome Platform without the need to integrate code, perform manual coding, implement SDKs, or deploy servers.
“Account takeovers are among the most serious threats facing mobile businesses today,” said Jason Bloomberg, Managing Director of analyst firm Intellyx. “Bad actors continue to up their game, and by the time an account is taken over, the damage is done. With Appdome’s Mobile Account Protection, mobile brands can prevent account takeovers by securing how user identities and account data flow in and out of mobile applications across the entire customer journey.”
The growing complexity of mobile applications, including Super Apps, the sophistication of threats, including those that leverage AI and AI-Agents, as well as the proliferation of on-device malware, have greatly lowered the barrier for attackers to carry out Account Takeovers in mobile businesses. Further, new tools and techniques are emerging to capture or exploit mobile identities and account data at the point of user entry, download, processing and/or choice in a mobile app. Traditional fraud detection and prevention products don’t safeguard these critical functions in the mobile application. Instead, these point products look for ATOs after the fact, often looking for the same attack vectors as other security and bot defense products to distinguish and mitigate fraud. Appdome’s Mobile Account Protection is designed to go beyond legacy security, anti-fraud and bot detection methods and protect the critical identity and account functions from deep inside the execution layer of the mobile application. If a threat is detected, Appdome’s AI-Native Mobile Account Protection plugins can either defend the user automatically or notify the application (or application backend) when fraudsters and other attackers try to compromise these functions. The result is proactive, pre-emptive defense to stop fraud and ATOs before they are successful.
“The missing link in properly defending against ATOs is protecting the myriad points of ingress and egress between the user and the service, including between in-app APIs, IPCs and CPCs” said Tom Tovar, co-creator and CEO of Appdome. “Fraudsters can already exploit these processes to access user credentials, session IDs, OTPs, authentication tokens, application state, memory and more on mobile devices at scale. So, brands and businesses must move the front line of ATO defense deeper into the execution layer of the mobile application.”
The thirty-two new AI-Native Mobile Account Protection plugins for the Appdome Platform fall into three mobile defense categories:
Appdome Trusted Execution Environment (TEE). This series of plugins allows Android & iOS applications to use a segmented and secure execution environment to create, store, and retrieve critical account, identity and transaction data within Android and iOS applications. Within Appdome’s TEE, Appdome protects the application memory, state, workers, activities, notifications, IPCs, APIs, and CPCs, performs session management, and provides a dedicated secrets manager for the application to use.
Dynamic Memory Protection: Attackers are increasingly targeting the mobile application memory to harvest account credentials, alter critical account information, or manipulate account values such as in program or loyalty abuse. Appdome provides a series of new plugins designed to detect when attackers attempt to access or dump the application memory, manipulate application values in memory, or harvest sensitive data and keys stored in an application’s memory with memory editing tools.
Identity Theft Prevention: Appdome’s new Mobile Account Protection suite now includes plugins designed to protect mobile application users from identity theft, including SIM swaps, overlay attacks, fake screens, key logging, tap hijacking, clipboard hijacks and more.
Combined, Appdome’s Mobile Account Protection suite ensures mobile accounts and critical account data in Android and iOS applications is secure and exploit-proof, adding a layer of fraud detection and prevention deep in the execution layer of a mobile app. This level of protection against ATOs and ODF has never existed in the mobile economy before Appdome.
“Most applications aren’t prepared for the emergence of sophisticated on-device fraud we’re seeing today,” said Chris Roeckl, Chief Product Officer at Appdome. “We’re entering a new era of fraud prevention, one where the attacker can exploit critical application values before, after, or beyond the scope of what stand-alone legacy RASP and anti-fraud measures can provide. Appdome Mobile Account Protection empowers brands and businesses to go deeper.”
The new plugins combine the power of choice-driven defense in depth, and no-code, no SDK delivery with innovative on-device detection, defense, and intelligence options to satisfy any implementation objective. All Appdome Mobile Application Protection Plugins are available with Appdome’s Threat-Events™ Intelligence and Control Framework and Appdome ThreatScope™ Threat Analytics service. Threat-Events allows mobile brands to gather data on each attack, control the user experience and create beautiful on-brand mobile experiences when attacks happen. Mobile brands can use Threat-Events to create unique workflows and user messages leveraging the power of their brand voice when threats are present. Mobile brands can track and monitor ATO attacks via Appdome’s ThreatScope™, either before or after the deployment of Mobile Account Protection features.
