Use case

Detect and stop mobile spyware on employee phones

Spyware such as Pegasus, Coruna, and DarkSword was once built only by nation-state actors and commercial vendors, and AI is now speeding up and commoditising these attacks. Reflex, Corrata’s on-device threat engine, picks up the suspicious traffic an infection creates, even when nothing is visible on the device, and acts the moment it does.

Sophisticated spyware uses zero-day vulnerabilities to deliver zero-click attacks on organisations in critical and sensitive sectors, and built-in phone protections have repeatedly failed to stop them.

Everyday malware can be just as damaging, tricking employees into installing fake apps and granting the dangerous permissions that expose company data.

How Reflex protects against spyware and malware

Reflex inspects network traffic on the phone itself and scans traffic, devices, and apps for indicators of compromise. It blocks access to malware download servers to reduce the chance of infection, and because it judges what traffic is doing, it can identify an infected device even when nothing is visible on it. When it finds an infection, it disables command-and-control traffic and isolates the device automatically, without waiting for a verdict from elsewhere.

Advanced spyware detection and response

Spyware detection

Pegasus, Predator, and other advanced spyware call for detection that doesn’t depend on a known signature.

Spyware is built to stay hidden on the phone, but it still has to communicate with its operators. Reflex reads details such as domain and server names, IP addresses, and SSL certificate metadata, and interprets a wide range of indicators to identify suspicious activity that tools relying on known threat lists miss.

Incident investigation

When Reflex flags suspected spyware, Corrata provides the tooling to investigate.

Corrata can collect detailed diagnostic information from an affected device, and employees can generate and submit device diagnostic files and packet captures. These files are vital for confirming an infection and understanding how the spyware operates.

Quarantining

Automatic quarantine contains an infection as soon as it is found.

Once an infection is identified, Reflex disables command-and-control traffic and isolates the device, cutting off its access to sensitive corporate data until the issue is resolved.

Preventing routine malware infections

Social engineering is used to trick employees into downloading fake apps and granting dangerous permissions.

Reflex blocks access to malware download sites to prevent installation, and Corrata tracks apps that use dangerous permissions, such as accessibility.

Removal of risky apps

Corrata prompts employees to remove apps identified as risky.

When a potentially harmful app is identified, the employee is alerted and guided through removing it, and the device’s security score reflects the risk until they do.

whitepaper

Guide to Mobile Phishing

Phishing on phones arrives through text messages, messaging apps, and QR codes as well as email. Download the guide to understand the mobile phishing threat and how to counter it.

Download

Frequently asked questions

What is mobile spyware?

Mobile spyware is software that secretly monitors a phone, giving attackers access to messages, calls, location, and files. The most advanced spyware, such as Pegasus, can be installed through zero-click exploits that need no action from the user at all.

How does Corrata’s mobile spyware detection work?

Reflex, Corrata’s on-device threat engine, inspects network traffic on the phone and scans traffic, devices, and apps for indicators of compromise. Because it judges what traffic is doing, it can identify an infected device even when nothing is visible on it. Our page on on-device network traffic inspection explains how this works.

Can spyware detection stop zero-click attacks like Pegasus?

Zero-click attacks need no tap from the user, so blocking malicious links alone cannot stop them. Detection depends on spotting the activity of an infected device, which is what Reflex looks for, and once it finds an infection it disables command-and-control traffic and isolates the device. Our history of iOS spyware from Pegasus to DarkSword shows how these attacks reach a phone.

What happens when Corrata detects spyware on a phone?

Reflex disables command-and-control traffic and isolates the device automatically, cutting off its access to corporate data. Corrata can then collect detailed diagnostic information for investigation, and where you run a SIEM, the threat data is forwarded so your team can work with it in the tools they already use.

Does mobile spyware detection mean monitoring employees?

Not with Corrata. Reflex works from network traffic details such as domain and server names, so it never reads messages, tracks location, scans files, or records browsing history, and Corrata’s servers only receive details of threats and the action taken. Corrata is EU-native, incorporated in the EU and headquartered in Dublin, and our page on privacy by architecture explains the approach.

Adversary-in-the-Middle (AiTM) protection that keeps phone traffic private on any network

Most enterprise data now travels over insecure networks. Corrata keeps employee communications private on unsafe cellular and Wi-Fi…
Device trust that checks every phone at the moment of login

Phones can access the same corporate data as laptops. Corrata ensures only devices known to be secure can…
Govern Shadow AI and enforce DLP on employee phones

Unsanctioned AI tools are a new route out for company data. Corrata lets you monitor their use and…

See Corrata on your own devices

A short call, a live look at the product, and a straight answer on whether it fits your estate.

Request a demo