AI in APK Analysis: Ask the Report, Triage in Chat
Droidwatch uses AI in two places: an assistant that explains a finished report, and a skill that runs APK triage from your AI chat. Neither sets the verdict.
Android Overlay Attacks: Platform Limits and Defences
How Android has restricted overlay windows from version 6 to 14, what banking trojans do instead, and the controls a banking app can apply on its own screens.
Static vs Dynamic Analysis of Android Malware
What static and dynamic analysis each prove about a suspicious APK, where each one stops, and how to decide when running the sample adds real evidence.
What MASVS and MASTG Actually Measure
The OWASP mobile standards grade security controls, not intent. Understanding that distinction is what separates a useful report from a misleading one.
How to Triage a Suspicious APK: A SOC Workflow
A six-step static triage workflow for classifying an unknown Android application, extracting actionable indicators and deciding what to escalate.
How to Identify an Unknown Android Package Name
A package name found in Settings, an MDM alert or a report proves nothing on its own. Five checks that establish what an unknown Android package actually is.
How Android Banking Trojans Work
Overlay, accessibility abuse, SMS interception and staged delivery: the four capabilities behind most Android banking fraud, and how each appears.
Scanning APKs in CI/CD Without Blocking Releases
Where a mobile security scan belongs in the pipeline, which verdicts should fail a build, and how to handle the failures without the team disabling the gate.
Analyze an APK Online: Inside a Droidwatch Report
A section-by-section walkthrough of the Droidwatch static analysis pipeline, the report it produces, and the boundaries of static analysis.