AndroWasm: an Empirical Study on Android Malware Obfuscation through WebAssembly
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2026
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866914339853697024 |
|---|---|
| author | Soi, Diego Sanna, Silvia Lucia Pisu, Lorenzo Regano, Leonardo Giacinto, Giorgio |
| author_facet | Soi, Diego Sanna, Silvia Lucia Pisu, Lorenzo Regano, Leonardo Giacinto, Giorgio |
| contents | In recent years, stealthy Android malware has increasingly adopted sophisticated techniques to bypass automatic detection mechanisms and harden manual analysis. Adversaries typically rely on obfuscation, anti-repacking, steganography, poisoning, and evasion techniques to AI-based tools, and in-memory execution to conceal malicious functionality.
In this paper, we investigate WebAssembly (Wasm) as a novel technique for hiding malicious payloads and evading traditional static analysis and signature-matching mechanisms. While Wasm is typically employed to render specific gaming activities and interact with the native components in web browsers, we provide an in-depth analysis on the mechanisms Android may employ to include Wasm modules in its execution pipeline. Additionally, we provide Proofs-of-Concept to demonstrate a threat model in which an attacker embeds and executes malicious routines, effectively bypassing IoC detection by industrial state-of-the-art tools, like VirusTotal and MobSF. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2602_18082 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | AndroWasm: an Empirical Study on Android Malware Obfuscation through WebAssembly Soi, Diego Sanna, Silvia Lucia Pisu, Lorenzo Regano, Leonardo Giacinto, Giorgio Cryptography and Security In recent years, stealthy Android malware has increasingly adopted sophisticated techniques to bypass automatic detection mechanisms and harden manual analysis. Adversaries typically rely on obfuscation, anti-repacking, steganography, poisoning, and evasion techniques to AI-based tools, and in-memory execution to conceal malicious functionality. In this paper, we investigate WebAssembly (Wasm) as a novel technique for hiding malicious payloads and evading traditional static analysis and signature-matching mechanisms. While Wasm is typically employed to render specific gaming activities and interact with the native components in web browsers, we provide an in-depth analysis on the mechanisms Android may employ to include Wasm modules in its execution pipeline. Additionally, we provide Proofs-of-Concept to demonstrate a threat model in which an attacker embeds and executes malicious routines, effectively bypassing IoC detection by industrial state-of-the-art tools, like VirusTotal and MobSF. |
| title | AndroWasm: an Empirical Study on Android Malware Obfuscation through WebAssembly |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2602.18082 |