App cloning: How to protect your mobile app from fraud

What application cloning is

Application cloning is the creation of multiple independent instances of one mobile app on a single device, using virtualization or sandboxing to separate each instance's data and processes. Android's open architecture makes it the main target. There are legitimate uses, but the technology is mostly turned against FinTech, ecommerce and gaming businesses.

Five kinds of fraud run on cloned apps.

• Promotion abuse. New-user bonuses and referral rewards claimed over and over from one device, which drains the marketing budget with no real users behind it.
• Monetization bypass. Metered usage limits, subscription paywalls and trial periods reset with every new instance.
• Ban evasion. A banned user comes back in a fresh clone, which makes platform rules unenforceable.
• Platform manipulation. Votes, ratings and product reviews gamed at scale.
• Account takeover and identity theft. Clones used to run many fraudulent accounts side by side, or to test stolen credentials.

Why cloned apps are hard to detect

Fraudsters obfuscate, and three things get in the way of detection.

• Spoofed device parameters. Fingerprints built on static identifiers such as Android ID or IMEI fail, because a virtualized environment can set those to anything.
• Sandbox-aware tooling. Current cloning tools, and the apps inside them, can tell when they are being analysed and behave normally until the analysis stops, which blunts dynamic analysis.
• Weak single signals. The presence of a cloning tool on its own produces false positives. Detection has to combine several signals and weigh them.

Mobile malware: The numbers

The figures from 2023 through mid-2025 set the scale.

• Android takes 90-92% of all mobile malware detections.
• Mobile threats make up roughly 20-25% of all malware incidents, and the share rose through 2024.
• Hundreds of thousands of new malware variants appear each day; some 2023 reports put it near 400,000 a day.
• Attempted malware attacks ran into the billions in 2023, with one summary counting about 5.6 billion attempts in the first three quarters alone.

What has changed in the attacks

Volume is half the story. The techniques have moved on too.

• Repackaged and cloned apps. Tens of thousands are detected each year, most of them imitating legitimate apps in finance and ecommerce to trick users into installing them.
• Banking and finance apps as the target. Reports from Q2 2025 describe ongoing repackaging campaigns against them and growing use of AI-assisted evasion.
• Sandbox-aware malware. Code that recognizes a researcher's virtual environment and stays dormant until it lands on a real device.
• Device and identity spoofing. Built into virtualized fraud toolsets, so the attacker presents as a legitimate user on a legitimate device.

What it costs

Industry summaries from 2025 project AI- and clone-assisted fraud at tens of billions of dollars a year by the mid-2020s, and some analyses put combined deepfake and AI fraud as high as $150 billion.

A layered detection framework

Detection works as a sequence of layers, each more expensive and more precise than the one before, ending in context-aware analysis rather than a single check.

Layer 1: Inter-process signal analysis

Objective: a fast first check for explicit flags from the OS or other security components that say the app is not running in a standard environment.

Mechanism: the detection code queries system properties and artefacts known to come with virtualization. Cheap, and still effective against known and less careful environments.

Layer 2: Package name and signature blacklisting

Objective: spot known cloning apps by checking against a maintained threat intelligence list.

Mechanism: scan the installed packages and compare their signatures against a list that is updated as new tools appear. Useful, but reactive: published studies note that it misses new or private cloning tools until they are widespread, so it cannot stand alone.

Layer 3: Behavioural and environmental analysis

Objective: use machine learning over a wide set of behavioural and environmental attributes to catch the anomalies that simple heuristics miss.

Mechanism: this layer runs when the earlier ones raise suspicion, or continuously. Rather than network traffic alone, the model takes a broad feature set. Published research reports results with features such as:

• API call sequences: abnormal patterns or frequencies of system calls.
• File system interactions: unusual file creation, access or modification paths.
• Sensor and resource usage: GPS, accelerometer and other sensors behaving as they would in an emulator.
• Permissions: the permissions requested compared with what the app does. Some research goes further and converts app binaries into images, then uses convolutional neural networks (CNNs) to find the structural similarities shared by repackaged and cloned apps.

Beyond the device: Correlating across the network

Device-level signals need network-level context, because cloned apps are run by organised rings, not individuals. Two research directions matter here.

• Graph-based analysis. Graph neural networks (GNNs) map the links between users, devices and transactions and surface clusters of apparently unrelated accounts that trace back to one operator running cloned apps, which is how large synthetic identity schemes get exposed.
• Federated learning. Training a shared detection model across many devices without centralising user data, so detection improves without a privacy cost.

On the server side, this is what device scoring at signup and login is for. When ten new accounts share the same hardware and network, the risk score says so and your rules decide whether they get in.

Where to start

The framework above moves detection from static checks to a system that reads behaviour and context. The next step is prevention inside the app itself. Runtime Application Self-Protection (RASP) builds the checks into the application so it monitors its own integrity and environment in real time, and when it sees tampering, debugging or virtualization it can act on the spot.

Treat cloned-app defence as part of the development lifecycle, not an add-on. Layered detection plus RASP and code obfuscation on the client, and device-aware risk scoring on the server, is the combination that holds up.

Frequently asked questions