1-Click Mobile Account Takeover via DeepLink
The Android app handled links of its own that opened deep inside the app. One of those handlers was exported to any other app on the device and decided whether a link was "ours" using a loose pattern instead of a strict check. We built a link that the pattern accepted but that actually pointed at our server. Tapped once, it loaded our content inside the app’s trusted session and handed us the victim’s authenticated state.
- Duration
- 3 Weeks
- Team
- 2 Mobile Security Operators
- Scope
- Mobile Application Testing (Android)
- Methodology
- Mobile SAST/DAST / OWASP MASTG
Attack narrative
Each phase references the MITRE ATT&CK technique used, with captured evidence.
- 01
Reconnaissance
T1592 — Gather Victim Host Information
Static analysis of the package surfaced an exported activity registered to handle the app’s deep links, reachable by any other app on the device without permission.
operator@proteqon: manifest-audit# Enumerate exported components and their intent filters$ mobile-audit components --apk client.apk --exportedactivity: DeepLinkActivity exported=trueintent-filter: scheme=https host pattern present[!] host validated by loose pattern match, not exact allowlist$ - 02
Analysis
Improper Input Validation — Pattern Bypass
The handler decided whether an incoming link belonged to the brand using a permissive pattern rather than a strict host allowlist. A link could therefore satisfy the pattern while resolving to an attacker host. The working bypass string is withheld.
operator@proteqon: validator-analysis# Reconstruct the host-trust decisioncheck : incoming link host ~ <permissive pattern>[!] pattern allows crafted host that resolves attacker-controlledverdict : trusted in-app context loads untrusted content$ - 03
Exploitation
T1204 — User Execution
We delivered a crafted link (message, page, or another app). A single tap routed it to the exported handler, which accepted it and rendered our endpoint inside the app’s authenticated context — exposing the session. Demonstrated against an operator-owned test account only.
operator@proteqon: deeplink-trigger (test device)# Crafted link redacted; fired at the exported handler on a lab device$ adb shell am start -a android.intent.action.VIEW -d "<CRAFTED LINK — REDACTED>"[+] DeepLinkActivity accepted the link[+] Attacker content loaded in trusted in-app session[!] Session material exposed -> 1-click account takeover$ - 04
Impact
T1539 — Steal Web Session Cookie
Loading attacker content inside the app’s authenticated context exposes the session, yielding account takeover from a single tap and with no further victim interaction.
Key vulnerabilities
Exported DeepLink Handler with Pattern-Based Host Validation
An exported activity validated link hosts with a permissive pattern, allowing a crafted link to load attacker-controlled content in the trusted app context and leak the session.
Sensitive Context Exposed to In-App Web Content
Content loaded via the deep link inherited authenticated app state, turning a navigation bug into account takeover.
Component Exported Without Need
The handler was reachable by any app on the device although it did not require cross-app exposure.
Remediation
- 01
Validate deep-link hosts against an exact-match allowlist; reject anything not explicitly permitted.
- 02
Unexport components that do not require cross-app invocation, and require verification for those that do (e.g. verified app links).
- 03
Never grant in-app authenticated context to content loaded from an externally supplied URL.
- 04
Add automated checks for exported components and loose link validation to the mobile release pipeline.
Outcome
Deep-link host validation rebuilt on an exact-match allowlist; the activity was unexported where not required. Re-test confirmed the bypass closed.
- 1
- Taps to Takeover
- None
- Permissions Needed
- Exported Handler
- Attack Surface
- 0
- Bypasses After Fix
All client identities, infrastructure details, and timelines in this report have been anonymized and adapted to protect confidentiality. Technique identifiers reference the MITRE ATT&CK framework. All offensive actions described were performed within a pre-authorized rules-of-engagement window; no production data was destroyed and no live systems were harmed.
Start an engagement
Want this level of rigor on your systems?
Book a 30-minute scoping call with a senior engineer. You'll leave with a clear recommendation on scope, approach, and timeline.