App replacement is an attack method where a legitimate application is swapped, patched, or repackaged into a malicious version. On mobile devices, this can mean the user opens the expected app icon and interface, but the code underneath has been altered to steal credentials, bypass protections, or hide warnings. Unlike a simple phishing page or overlay, the trusted app itself becomes the attacker’s tool.
This matters because many security decisions depend on the app being honest about its own state. If malware can modify the client, it may disable security checks, capture banking credentials, or suppress alerts before the user notices. Defenders look for signs such as unexpected app installs, suspicious permission changes, abnormal Accessibility use, and unusual login or transaction behavior. Strong app signing, device integrity checks, behavioral analytics, and server-side fraud detection help reduce the risk, but they work best when the device is treated as potentially compromised.