You have now been logged out of the Support Portal.

Banking malware is finding ways to make malicious activity look like ordinary customer behavior. Research into Herodotus and other Android threats shows how protected in-app signals can give fraud teams a clearer picture of what's happening during a banking session.

A side project to track protected apps led our researchers to Hirudo malware and a leaked Android attestation keybox. We reported the leak to Google and recreated the attack to test whether Promon Shield could withstand it.

Gaming fraud systems can see what players do, but not always what is happening inside the game client. In-app runtime signals add that missing context, helping teams connect manipulation with wider player, account, and device behavior, to ensure successful launches, fair play, and community respect.

In the publicly documented malicious campaigns reviewed for this post, we found no evidence of an AI agent running the full attack chain against a mobile application. But AI is already taking over individual stages, changing the economics of reverse engineering, runtime instrumentation, and attack adaptation.

Cybersecurity Awareness Month 2026 is about making life harder for attackers. At runtime, that means raising the cost of analyzing, tampering, and abusing web and mobile applications.

AI is beginning to take over the decisions between automated attack stages, not just execute the steps themselves. As systems learn from results, pivot approaches, and coordinate with other agents, the attacker starts to behave more like a feedback loop.

Independent security researcher 0xobfuscated developed a protection-bypass technique against Promon Shield for Mobile™ on Android. They contacted us before publishing, giving our teams time to investigate the research, strengthen the protection, and make updated releases available to customers.

Attacks no longer stay inside one app, one region, or one stage of the kill chain. A runtime intelligence loop helps app protection learn from the wider threat picture. Then it turns that learning into detectors, policies, and controls that run locally inside protected apps.