{'fraction_non_alphanumeric': 0.02456968135466948, 'fraction_numerical': 0.009297055673687315, 'mean_word_length': 5.228731631863883, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 1, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 11, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Analysis of Mobile Malware: A Systematic Review of Evolution and Infection Strategies

The open-source and popularity of Android attracts hackers and has multiplied security concerns targeting devices. As such, malware attacks on Android are one of the security challenges facing society. This paper presents an analysis of mobile malware evolution between 2000-2020. The paper presents mobile malware types and in-depth infection strategies malware deploys to infect mobile devices. Accordingly, factors that restricted the fast spread of early malware and those that enhance the fast propagation of recent malware are identified. Moreover, the paper discusses and classifies mobile malware based on privilege escalation and attack goals. Based on the reviewed survey papers, our research presents recommendations in the form of measures to cope with emerging security threats posed by malware and thus decrease threats and malware infection rates. Finally, we identify the need for a critical analysis of mobile malware frameworks to identify their weaknesses and strengths to develop a more robust, accurate, and scalable tool from an Android detection standpoint. The survey results facilitate the understanding of mobile malware evolution and the infection trend. They also help mobile malware analysts to understand the current evasion techniques mobile malware deploys. * Corresponding Author: Moses Ashawa Email: m.ashawa@cranfield.ac.uk doi: 10.26735/KRVI8434

The research published by the UK Department for Digital, Culture, Media & Sport in 2020 shows that malware caused 87% of the total cybersecurity attacks that caused financial loss [16]. In addition, the growth of malware attacks on mobile devices continues to increase despite the number of industrial solutions, scant systematic reviews, and meta-analyses focusing on identifying strategies mobile malware deploys as infection strategies or attack vectors to infect mobile devices. Also, while there are several mobile malware detections, classification, and analysis techniques, the systematic review and meta-analysis of the infection strategies are deficient. Our systematic meta-analysis aims to look at the mobile malware evolution and infection strategies. Manymobile malware attack goals can be fragmented into the motives and the behavior related to the motive. The World Economic Forum (WEF) threat risk report highlighted that every cyberattack caused by malware leaves indelible impacts, even after the malware has been detected and removed [17]. This paper has the following aims: (1) To advance understanding of the mobile malware history and its position in the cyber threat landscape, examining the major security threats to mobile devices; (2) To provide a discussion on the evolution of Android malware to identify security transformation and propagation modes adopted at each evolutionary stage; (3) To examine different evasion techniques adopted and their security implications; and (4) To critically examine android malware infection strategies and raise recommendations and awareness of malware impacts and how to curb the attacks and infection rates. Our research made the following contributions: • Providing an up-to-date study of mobile malware evolution and infection strategies.
• Classifying mobile malware evolution trends into distinct categories based on their sophistication, characteristics, and the motivations behind attacks.
• Providing a general overview of the mobile malware infection model based on the meta-analysis of the infection strategies.
• Identifying factors that limited the fast spread of the early mobile malware. These include livelihoods. Government and non-governmental organizations have been compelled to adopt precautionary measures and adapt to remote working during the pandemic, with little or no adequate and necessary training of their employees to be cyber smart when working remotely. Even for those that have the training, working from home on a poorly secured network is a concern. As a result, cybercriminals are exploiting individuals and government vulnerabilities for financial gain through pandemic-related threats such as fraud, phishing, and malware. Among the cyber threats, the research of Cristea [6] reported that malware attacks on mobile devices are the most challenging current security threat in the national and international context. Malware has evolved and has become sophisticated, so detecting of some variants becomes very difficult. McLaren et al. [7] stated that bot writers deploy evasion techniques like code encryption to make detection by pattern recognition less effective.
The advancement in mobile technology has brought about corresponding effects on mobile malware, which attacks mobile devices. Among the mobile OS, Android is the fastest-growing OS used worldwide [8], [9], [10]. Research has shown that the Android operating system outran other mobile OS due to some factors such as ease of use, affordability, open-source code, and compatibility commitment [11], [12], [13]. The first malware, called Creeper [14], was created to target personal computers, but as technology advanced, malware evolved to attack mobile devices as well. The first mobile malware, known as Cabir [15], was designed to target Symbian-based mobile platforms. Since the advent of Cabir, mobile malware has evolved into different variants and with differing complexities. According to the cybersecurity report released by Check Point software technology [6], mobile malware is one of the current security threats at national and international levels. Unlike PC malware, mobile malware has become so pronounced due to the enormous amount of personal and financial information cybercriminals harvest from those devices. Consequently, data breaches and financial loss cases caused by mobile malware keep increasing.
(a) the lack of mobile OS standardization, (b) the lack of mobile OS cross-platform, and (c) the lack of Bluetooth technological advancements in data communication.
• Identifying factors that enhance the fast spread of recent mobile malware. These include (a) the advancement in threat dimensions, (b) improved security and business communication on Tor using a multi-signature transaction and encryption approach, (c) mobile platforms' integration with the IoT-based applications, and (d) the emergence of evasion techniques and the advancements in mobile malware Toolkits on the dark web.
• Providing recommendations as countermeasures to cope with emerging mobile malware and its increasing threats. These include (a) the deployment of software solutions from enterprise mobility management to enhance the security of enterprise devices, (b) observation of mobile application plugins and codecs during mobile application download and installation, (c) the adoption of risk mitigation strategies by organizations, and (d) development of a mobile malware infection model to understand the immunity state of a mobile device during and after recovery from malware infection.
The remainder of the paper is structured as follows: Section II provides the research methodology, section III provides the background of the study, Section IV presents the discussion, Section V presents the infection and attack vectors, and Section VI presents the conclusion.

II. Methodology
Scientometrics was used to assess and analyze the finite features of the selected papers used for this study [18]. The source of literature for this study came from the Web of Science collections. Field tags such as parenthesis, wildcards, Boolean OR operator, and quotation marks were used to create the query for exact words and phrases. Two datasets (core dataset (CD) and extended dataset (ED)) were ultimately used for our study. Web of Science retrieval was used to obtain the core dataset which contained many kinds of literature. For further filtering, the repeated literature was eliminated using CiteSpace, a function of the Web of Science as shown in Fig. 1. The final database was then generated, combining the core and expanded dataset containing the reviews and the articles. The topic search (TS) was used as the target to perform a holdout data search to pull out all the keywords essential for both the core and extended dataset. This was to determine the total increase in node purity of the most important variables (Keywords) in the TS Fig. 2. In summary, different articles were collected during the filtering process. However, only 243 papers met our selection criteria, including time span and language. For instance, some papers contained keywords, but the content was written in languages other than English. Many more were eliminated according to our selection criteria.
To discover the essential organization of the CD and ED, we conducted an exploratory factor analysis [66] using the applied rotation method, simplimax, to identify latent keywords that were not observed but share common variances. The aim of conducting the exploratory factor analysis on the combined dataset generated was to enhance the complexity reduction of the large data (articles and reviews). The exploratory factor analysis brought out the factor correlations and the uniqueness characterising the CD and ED articles with their influencing TS tag-keywords as shown in Fig. 3.

A. History of Mobile Malware
General malware appeared in the 1970s when Bob Thomas wrote a self-replicating virus called Creeper Worm. Creeper worm was Adware that displayed popups on systems with the message "I'm the Creeper, catch me if you can!" [19], [20], [21],. After the emergence of Creeper, other significant PC malware such as Wabbit [22], Elk Cloner [23], Brain Boot Sector Virus [24], PC-Write Trojan [25], Morris Worm [26], Michelangelo Virus [27], and Melissa Virus [28] also emerged. The emerging technology in mobile devices has brought about a proportional malware threat to mobile devices. Smartphones are speedily substituting PCs both in the workplace and at home. Most activities such as web surfing and financial transactions rely   on mobile devices. Due to the increased dependence on smartphone devices and the financial information they store, malware writers' attention has significantly shifted from PC to mobile devices. s According to Shah et al. [29], the history of malware attacks on mobile devices can be traced back to 2004 when the first mobile malware called Cabir was written by Vallez to target Symbian-based devices. Being a worm, Cabir injected its payload into the victim's devices via Bluetooth file-sharing as a spreading mechanism. The malware was not sophisticated in its operation. It displayed annoying popups that made the infected mobile device unpleasant to operate. Due to the limitations of Bluetooth technology in data communication, slow data speed, and short signals, the rapid spread of the malware was impeded. Another factor that impeded the rapid spread of Cabir was the fact that the devices had to be close to each other to establish a connection before the infection could occur. The lack of standardization in mobile OS was also another limiting factor that inhibited the rapid spread of Cabir.
Another mobile malware called Skulls [30] was developed in the same year with criminal motives and later formed the basis of PC malware. The later malware was found to overwrite mobile application files and substituted applications' icons with crossbones and skulls that stopped mobile device functionalities. In 2005, malware moved into the realm of information theft when more dangerous mobile malware called Commwarrior and Pbstealer [31] were discovered targeting the Nokia 7160. Both Commwarrior and Pbstealer targeted and harvested information-sensitive data such as passwords and usernames using nearby connected mobile devices. Looking at the malware pattern, the study by Mayrhofer et al [32] shows the paradigm shift in malware development from Symbian devices to Android, particularly the development of malware for Java 2 Micro Edition (J2ME).
The major trend followed by malware writers in this paradigm was developing malicious codes using J2ME to send premium rate texts or using SMS as a social engineering mechanism to trick victims into confirming non-existing financial operations.  The first android mobile malware was called "AN-DROIDOS_DROIDSMS.A" [33]. It was detected as a Trojan in 2010 by Trend Micro, while the Ikee worm was also uncovered for iOS-based devices (Apple iPhones). The mobile infection trend in this era focused on phone jailbreaking, rooting, Rickrolling, and changing the phone background to display Rick Astley's image leaving the message on the screen "Ikee is never gonna give you up" [34]. Android malware was originally spread by using third-party application marketplaces, due to android openness in its App ecosystems circulation, which undoubtedly accelerated this misuse, unlike Apple.
From 2011 till date, there has been a progressive growth of malware threat complexity. For Android, the kill switch was used by Google, but the challenge remains that the kill switch will not be effective if an earlier download has an infection on the device. iPhone/FindAndCall [35] and Android/ DroidKungFu [36] malware snip individual data and forward this personal information to remote network servers. Other malicious software such as FinSpy, Android/Nickispy, and Android/Spybubble have been developed to record mobile phone calls, send SMS, and monitor mobile location as spy instruments. The research of [37] observed that the number of malware attacks on android from 2013 grew to 98.05% compared to Symbian (0.27%), J2ME (1.55%), and others (0.13%), as shown in Fig. 4.
The study by Chen et al [38] asserted that malware infections and threats on mobile devices are increasingly spreading to affect other smart devices such as smart cities, smart TVs, smartwatches, cloud-based technology, and IoT device platforms. This shows the susceptibility of smart devices to attacks such as buffer overflow, which can be deployed by hackers to remotely control those devices. Apart from attacks on smart devices, the medical field has recently been severely affected by the number of malware attacks. Malware attacks cardiac devices and reconfigures them [39], resulting in failures during cardiovascular implantation and, thus, putting the lives of patients at risk. The attack of WannaCry Ransomware [40] on the UK NHS infrastructure in 2017 affected several NHS com-puters have a considerable effect on the system operation and patients records.
From the above history, we noted that many malware codes were written for fun and probably for behavioural testing of software from the beginning. However, evolution in writing malware has increased the complexity of its impacts on financial institutions, businesses, and information leakage. It has evolved to be used for financial gain, vengeance, system sabotage, cyberstalking, and political influence. Table I shows a detailed review of major mobile malware incidents and evolution and propagation strategies.

B. Evolution of Android malware
Android open model architecture is one of the potential factors that encouraged fast malware progression, where the Google bouncer uploads malware applications written by hackers on the play store without adequate security checks. The Android open framework model is one of the major factors that pose a security risk. The open-source nature of the Android platform enables OS modification by the manufacturers for feature enhancement and thus makes the source code susceptible to attackers. It also provides opportunities for tinkering the OS-based devices, thus, weakening the security of the device.
In 2010, AndroidOS.DroidSMS.A [41] emerged as the first Android mobile malware. AndroidOS.   DroidSMS.A is a fraudulent application for the SMS premium rate. Using SMS services, the Trojan subscribes to victims' Android devices. The affected devices received different text messages at a premium rate using automatic subscription premium SMS service. AndroidOS.DroidSMS.A installed itself on the phone once permission request attributes related to SMS features were granted. Another Trojan discovered in the same year was Tap Snake [42], which propagated via HTTP by acquiring the victim's device location via GPS or network services. Tap Snake masqueraded as a mobile game but was a spy tool, remotely monitoring mobile conversations and locations. The monitored data are then forwarded to malicious servers in the background for further attacks and vulnerability exploits. AndroidOS.DroidSMS.A and Tap Snake Trojans were wreaking havoc on Android in 2010. Their counterpart Ikee worm [43], [44] was jailbreaking iOS-based mobile devices to use an SSH password. Based on the meta-analysis of their operation mode, we can assert that it was very easy to avoid being infected by Tap Snake if users pay attention to the services the application requests to access. For instance, during the installation, it requests permission to access network communication, device location, and system tools. We can infer that this infection could have been avoided if users prioritise their security over the need to use the masquerading applications.
Three other Android malware that emerged in 2010 included SMSReplicator, Geinimi, and Fakeplayer [45]. Both AndroidOS.DroidSMS.A and the Tap Snake game did not infect many devices, because the attack vectors were limited due to a lack of cross-platform propagation ability. According to the research of [46], [47], another factor that limited the spread of those Trojans was that Android (4.45%) was still not as popular as Symbian OS (34.33%), iOS (32.92%), and BlackBerry OS (10.16%). Apart from cross-platform propagation limitation and lack of Android popularity, other fac-  tors such as low mobile features like weak internet connectivity and short Bluetooth range were also contributing factors that repressed rapid propagation of the first emergent malware. The common behavioral goal amongst the two malware applications is their monetization motive towards the mobile space.
While only a few Android malware families emerged in 2010, the number of Android malicious applications multiplied greatly in 2011 with over 44 different Android malware families discovered. Among the variants discovered, DroidDream [48] was one of the notable families that rooted the victims' devices to steal sensitive data. Thus, android malware evolved from SMS premium to modification of mobile functionalities. While the family of DroidDream focuses on stealing users' private information, the Genimi family [49] takes control from the attacker's remote server. DroidDream was an Android botnet type of malware which stole Unique Identification Information (UII) by gaining root access to the victim's Android device. Hackers were able to control the infected devices remotely by abetting automatic download of other malicious files without the victim's awareness or authorisation.
As noted in the study of Yan and Yan [50], the emergence of this malware family led to the mainstream Android malware Toolkits. This became the foundation of the mobile cybercrime market worldwide. As the attack success progressed, Droid-Dream and its likes were sold on the dark web illegally where virtual access can be deployed to harm. This evolution made Android-malware-spreading kits available and accessible worldwide. We can infer that this evolution made buying, ownership, and deployment of Android malware easy. Hackers pay for the toolkits in Bitcoin and are provided with the necessary tutorials needed for effective Android malware infection. This led to a rapid proliferation of malware samples and the corresponding attacks.
Opfake [51] and Fakeinst [52] were the most prominent Android Trojans discovered by Kaspersky in 2012, with over 1,083 Android malware samples discovered by different security companies such as Kaspersky and F-Secure. Most of the Android malware samples were the repackaged versions of legitimate applications, which lead to the policing requisite of developing techniques that could detect repackage applications. Our research observed that this malware family adopted drive-by downloads and updated attacks to infect victims' devices, which was more difficult to detect. According to Meng [53], samples of the families discovered in 2012 could influence root exploits to completely compromise the security of Android. Thus, this presented a high level of privacy threats to the Android community. Some of the Android malware families in 2012 had inherent attributes of the 2010 and 2011 samples. Similar attributes included sending premium text messages, turning compromised devices into botnet, harvesting users' account details and calling in the background without the awareness of the owner. Root-level exploitation by these Android malware families caused poor security stability of the Android OS, leading to other different consequences such as device bricking, loss of device warranty, financial loss, and more openings of attack surfaces to make the compromised devices more vulnerable to attacks. Other Android malware, Plankton [54], [55], [56] and Foncy IRC bot later emerged towards the end of 2012. Kaspersky reported that the latter was not as sophisticated and prevalent as Opfake and Fakeinst.
While mobile security was devising strategies to tackle the spread of emerged Android malware, new variants of Android malware emerged in 2013, namely Fave-Av-Reader, Plapka, Simplocker, Rough_Skype, Dendroid [57], among others. The most sophisticated among thousands of variants discovered in 2013 was Obad. Android malware Code obfuscation was the first experience with the emergence of Obad Trojan. Writers of Obad infused obfuscation techniques that enabled Obad to take the role of device administrator in the background. We can infer that Obad was a backdoor Trojan that used cracked sites and Playstore for pinging precise resources through pre-defined SMS strings. Financial platforms such as mobile banking apps, e-wallets, and credit card thefts were major attack goals for the Trojan, as highlighted by Austin [58]. The emergence of this malware trend leads to an increase in Android cybersecurity black markets where stolen data are sold. The obfuscation meth-od adapted by 2013 Android malware developers to evade detection by anti-malware engines is a factor that advances the fast propagation of Obad Trojan.
Due to the obfuscation technique, the static analysis would be much harder to achieve by cybersecurity experts and anti-virus engineers than could be done on the previous trends. While root level exploit was common in the previous trend (2012), Obad exploits zero-day weaknesses to gain more and higher privileges on the infected devices.
The 4G-enabled Android devices involved a technological shift that motivated malware writers to exploit further vulnerabilities existing on Android phones via off-the-shelf creation of malware tools and deployment strategies. This led to many Android malware families being discovered in 2014; many samples displayed the same features seen in the previous variants. The notable Android malware family that exhibited unique characteristics from the already known samples between 2010 and 2013 is NotCompatible.CA as highlighted by Ariyapala et al. [59]. NotCompatible.C is self-protecting and persistent through encryption and redundant activities, thus making static analysis hard to achieve. Being a botnet kind of Android malware, over 8.5 million devices were infected via spam emails.
Notable impacts of NotCompatible.C included WordPress accounts cracking and the bulk purchase of event tickets from the infected devices. Unlike previous families, dynamic analysis became very difficult on NotCompatible.C due to its awareness of the emulated and virtual environments. Due to its obfuscated method, it can evade the vetting processes on play store and anti-virus products. Scalability, clustering, and memory analysis may be essential as the Android malware analysis approach with the annual increase in the sophistication and explosion of different Android families. The obfuscation of the botnet made the Android security threat more formidable. The mode of operation of NotCompatible.C malware as shown in Fig. 5, shows its propagation strategies.

C. Dark web advancement and new malware variant
In 2015, different Android malware emerged such as Spy, Simack, Jssmsers, Benews, Braintest, Feabme, and Xbot [60]. However, an unknown Android Trojan is comparatively new and different from the former ones, which focuses on harvesting banking details via SMS interception. The Trojan specializes in sniffing banking-related SMS, emails, and forwarding the sniffed data to a hardcoded phone number and email service based in China. While analyzing the intercepted SMS, keywords such as balance, pay, bank, validation, and check are sniffed as part of the data collection and information gathering process. Several Android mobiles infected by the Trojan experienced bruteforce which enabled the Trojan to take advantage of the infected devices to exploit the security vulnerabilities and collect sensitives information. Some researchers revealed that user privacy as mobile numbers stored in the database and address book faced security threats when stolen by hackers [61]. Cybercrimes such as identity camouflage become easy to perpetrate when the user's geographical location and phone number are is leaked. Also, many mobile banking apps require the owner's mobile number during registration associated with their location.
As the Dark web technologies advance, diverse means are provided where criminal actors (including malware attackers) engage in secure communications and transactions of malicious toolkits and other products and services. Android malware continued evolving with different attack strategies and evasion techniques. Android malicious Buyers and vendors began to exploit the security and business mechanisms on Tor using a multi-signature transaction and  encryption approach to spread malware. Secure communications and transactions on malicious applications as software packages became a business of interest on forums and vendor online shops [62], [63], [64]. Different Android malware families include Rumms, Krep, Triada, Descarga, Mazar_Bot, Rootnik, AndroidOS.Fusob, and DroidJack emerged in 2016 [65][66][67]. According to the mobile security report by Mead et al. [68], AndroidOS.Fusob Trojan ransomware was the most popular and persistent android malicious program in 2016 that infected users in different geographical locations including the UK, US, China, and Germany. Over 230 countries were attacked by Android malware with varying degrees of threat and impact. Some of the stolen information was sold in the dark web market.
One interesting observation is that Android malware began to evolve to infect wider geographical locations, unlike the previous variants and families. Hackers began to decompile legitimate applications and repackage them with embedded malicious code to sell to the marketplaces and increase financial gain. Android malware evolved to a more sophisticated level when AndroidOS.Fusob and DroidJack were used as RATs and can survive a factory reset. These variants were used for statesponsored attacks and espionage according to Li et al. [69]. Due to their open-source nature, leaked sourced code, and special plugins, the Fully Undetected Remote Access Trojans (RATs) market began to mature with this evolvement of Android malware.

D. Smart malware evasion trends using technological techniques
Android malware took a new dimension when the repackaging of Android applications became very popular in official and third-party markets in 2017. Hackers began to repackage benign applications using reverse-engineering techniques. Consequently, trust in an application has diminished due to repackaging techniques by hackers. Trust in applications influences mobile users' decisions on which market store to download applications from. Mobile vendors must trust that mobile users get legitimate applications during purchases on the marketplace.
According to [70], the Dark Web became a web of cybercriminals where Android and other RATs are sold openly for high prices on Clearnet but with a lower price on Dark Web. Kaspersky reported that in China, AndroidOS.Fusob changes the PIN code and enables Android safety function by resetting the infected device PIN to their Passcode. Android malware continued to evolve through 2016. Different Android malware types significantly grew, especially with the growth in RiskTool. According to Kaspersky, RiskTool files increased from 29% to 43% in 2015 to 2016, respectively. According to the report, Trojan ransom experienced the most significant growth in 2016 with an increase of 4%, which was nearly 6.5 times higher than in 2015.
Trust must be a fundamental component of mobile applications. Mobile applications are being used daily for transactions and other inter-personal collaborations and interactions. However, the trustworthiness of these services and applications, especially in the market store, is still a concern that needs thorough security implementations and checks. The study by Khanmohammadi et al [71] highlighted that the percent of repackaging android applications grew to 54.38% in 2017 with permissions added in the repackaged applications. The number of malware attacks on Android mobile devices continued to rise from the beginning until the end of 2017.
According to Kaspersky Lab security bulleting [72], Android malware increased about 1.2 times more in 2017 than in the previous year. According to the report, rooting malware is the biggest security threat Android users experienced in 2017, and the percentage of its effects keeps increasing. Super-user rights were gained by the rooting malware (Ztorg) and system vulnerabilities were exploited. The rooting malware was distributed through the play store, which infected and modified over 100 Android applications. This malware family did not affect many devices due to the limited number of Android devices running older versions. While 230 countries were affected in 2016, the rooting Trojan infected only 161 countries in 2017, according to the Kaspersky report. To keep pace with the security threats presented by potential harmful applications (PHAs) [73], Google introduced multiple layer security architecture during its review of Android security in 2017. The multiple layers of the security and protection architecture advanced to form Google play protection. Though Google play protection has been a fundamental security feature in Android, other features were added in 2017 for better identification of potentially harmful applications on Android devices. Features such as regular updates of Google play were introduced so that the update no longer depends on Over Air updates (OTAs) for security improvement. Our research, however, observed that Google play protect was not sufficient for the total protection of PHAs because its enablement was only on Android devices running 4.3+ versions.
Devices running lesser (older) versions were still subject to PHAs and application exploits. In summary, while the number of Trojan-SMS decreased significantly in 2017, Trojan-Ransomware increased by 5.22% in 2017 compared to 2016. In 2018, Android malware took a different dimension of attack, infection, and propagation strategies, though a built-in mechanism for defense against PHAs was enhanced in the previous year. Potential Harmful Applications infected mobile platforms that installed applications from outside the play store eight times more than those from Google play. While Google Play Protect played a significant role to reduce the rate of mobile infection in 2017, other protection mechanisms such as application sandbox [74], hardened APIs [75], discrete tamper-resistant [76], and BiometricPrompt [77] were developed in 2018 to bring about a reduction in Android malware attacks. The introduction of these security mechanisms in conjunction with platform improvements of Treble [78], [79], original equipment manufacturer (OEM) agreements and Android Enterprise Recommended has significantly advanced and improved the Android ecosystem security.
Despite all the security advancements, 0.11% of Android mobile devices were compromised by user-wanted (UW) PHAs called Chamois [80] in 2018. Other variants such as Snowfox, Cosiloon, BreadSMS, View SDK, Triada, CardinalFall Eager-Fonts, and Idle Coconut [81] later emerged with similar characteristics. Chamois was, however, judged to be more sophisticated and injected several sideloaded applications because it infected over 20 million android users. As demonstrated in Fig. 6, the backdoor generates invalid traffic, performs artificial application promotion, telephone fraud, and dynamic execution of additional plugins.
The User-wanted PHAs disabled SELinux and root Android devices by disabling the SELinux security feature. SELinux disablement led to increasing  pre-installed PHAs and increased threats of backdoor SDKs. Also, the excessive privileges permit potential harmful applications to defend themselves against any attempt for removal by users. Backdoored SDKs code injected into genuine Android functionalities significantly enhanced the propagation of pre-installed PHAs that compromised Android device integrity, click fraud, and attribution fraud. Compared to applications downloaded outside of the play store, the rate of PHAs was high compared to those from Google play as shown in Fig. 7.
Android malware continues to increase in both scope and complexity, despite the security implantation in the Android operation system. The more the security experts deploy techniques to detect and prevent attacks, the more adversaries deploy alternative and innovative strategies to adapt to the current security situation. This was evident when a sophisticated Android malware family known as TimpDoor emerged in 2019 with unique attributes and rapid propagation and threats. TimpDoor malware bypasses the play store by infecting Android victims through SMS. According to the McAfee threat report [82], the TimpDoor malware family proves extremely effective by infecting more users than the older known Android malware families. The spyware exfiltrates victims' contact, photos, and SMS. The evolving functionality observed of Timp-Door is that the malware uses a SOCKS proxy that redirects traffic. The most probable attacks added by this evolution are click fraud and DoS attacks.
The most worrying characteristic of this threat is the use of filched data such as photos and phone contacts to create false accounts on social media and other online services to steal more identities of users and attack Android-based IoT devices. As shown by Kumar et al [83], the Android platform's integration with IoT-based applications facilitates malware propagation. IoT revolution has covered different spheres of life including remote monitoring, the healthcare sector, and there are many others that create attack platforms for extensive exploitation of Android-IoT devices. This is a result of the malicious data storage in the IoT blockchain which most of the time is undetected and hard to access for analysis. The study by Taylor et al [84] affirms that malware data deposited in blockchain history are easily transferred via the network and the propagation attack surface enlarges, thus infecting many devices. Though TimpDoor was more sophisticated, LeifAccess Android malware impacts were significantly felt in the USA more than in any other country. 2020 witnessed the tremendous effects of COVID-19 that resulted in lockdown worldwide. While the threat actor strategies and procedures are the same, organizations' exposure to risk levels has greatly increased due to slow response and recovery approaches during the pandemic. As employees continued working from home due to the COVID-19 pandemic, different variants of Android malware emerged. Most employees prefer to use their mobile devices for personal and busi-

Analysis of Mobile Malware: A Systematic Review of Evolution and Infection Strategies
ness transactions under a poorly protected home network. According to the Deloitte security report [85], the contact tracing application launched by the NHS has become a threat actor for social engineering leverage that tricks users into installing fake and malicious COVID-19 contact tracing apps. According to the report, the fake COVID-19 application is being used to deliver different threats.
A new Android mobile malware Unicorn emerged in Italy that targets doctors, pharmacies, businesses, and universities. The ransomware uses social engineering to encrypt users' devices and requests a ransom in euros. Other malicious threats such as email spam, fake landing pages, phishing, and so on emerged when four other variants of the same malware surfaced later. One of the major evasion strategies adopted by recent malware is the Trojan defense approach, as identified in the security report of ESET [86]. Table II summarises Android malware evolution from 2010 to 2020.
Based on the papers examined as part of this study, we classified mobile malware evolution into five (5) categories based on sophistication, characteristics, and intents: Category 1: This group of mobile malware is characterized by annoying pop-ups and ads usually displayed on the mobile screen. The propagation mechanism is usually via SMS, MMS, and Bluetooth. The intent is for fun, behavioral software testing, knowledge testing, or both.

Category 2:
This group of mobile malware is characterized by information theft and privacy violation. The propagation mechanism is usually via social engineering, drive-by download, and key-permutation. The intent is for knowledge testing and financial gain.

Category 3:
This group of mobile malware is characterized by device rooting, jailbreaking, and rickrolling. The intent is for financial gain and physical damage to the mobile device. The propagation mechanism is usually via the third-party application and marketplace.

Category 4:
This group of mobile malware is characterized by remotely accessing mobile devices. The intent is for financial gain, industrial espionage, vengeance, organization of state-sponsored attack, buffer overflow, remote monitoring, installation of other Trojans, spying, and stealing corporate secrets. The propagation mechanism is usually the internet.

Category 5:
Our research referred to this group of mobile malware as modular malware. This group of mobile malware can gain administrative rights of a device and can perform a DDoS attack. The propagation mechanism is usually the internet.

E. Classification of Mobile Malware
Smartphone development and its popularity have brought about a surge in the number of mobile variants. Despite anti-malware advancement solutions, sophisticated malware variants use techniques such as code encryption, code obfuscation, among others to evade detection. The advent of COVID-19 has accelerated mobile and PC variants, because most workers work remotely using unsecured and weak security networks with no physical monitoring and the help of IT support teams. As businesses face economic insecurity due to the advent of the pandemic, the number of cyber threats such as mobile malware is also increasing correspondingly, as highlighted by Brown [87]. It will be unjust to expect employees who work at home using the home network with weak security to be able to protect themselves and their organizations from being attacked by malware without understanding malware variants. Our review examined some of the malware variants and their modus operandi.

1) Ransomware
Although ransomware is commonly experienced on computers, mobile devices are not immune from being infected with this type of malware. Ransomware attack locks the mobile screen and encrypts files with a displayed ransom message, usually demanding a Bitcoin payment. Android ransomware is currently increasing, and it is of paramount significance to have a defensive approach that will guarantee the data security of mobile users. Most of the defensive approaches are signature-based and, thus, ineffective for the current state-of-the-art malware variants. Mobile ransomware is a malicious variant whose design and operation block entrance or access to a mobile device until the amount of money is paid. Recent research has shown that 74% of companies in the 21st century are under terrific ransomware siege, especially those whose operations are connected to mobile devices [88].
Mobile ransomware harvest data such as photos, videos, usernames, and passwords related to a financial transaction.

2) Adware
Initially, adware was known for the annoying and frustrating pop-up characteristics without any specific malicious intent. However, it has now moved from the realm of just pop-up displays to data collection. Some adware goes as far as rooting (for android) and jailbreaking (for Apple) mobile devices, while others have the capability of draining the device battery when not observed and prevented. Mobile adware such as Cydia [89] steals user data and modifiers mobile IMEI, IMSI, and steals android mobile Transaction numbers (mTAN). Mobile adware has evolved from creating banners and ads to easy and un-noticed mobile rooting and jailbreaking. Some create adverts as a link to lure victims into malicious sites for auto-download of malicious applications once visited. For instance, a banner or an ad may appear on your phone screen while online with the statement 'Amazon is giving out £350 worth of voucher cards, click the link below to claim yours. This trick harvests sensitive data used to carry out sophisticated attacks. These details are then used to launch an attack on the victim's mobile device. Some adware variants create backdoors on mobile devices when infected to facilitate further and future attacks. Some adware could deploy social engineering tactics to lure the victim into divulging sensitive information that is after that used for the attack.

3) Trojan
Android Trojans are camouflaged as legitimate Android applications. Trojans harvest sensitive information on a device, spy on the user's activities, delete the user's files, and can download other malicious activities. The study by Imtiaz et al [90] reports that some Android Trojans masquerade as legitimate mobile banking applications, mostly targeting android mobile phones. The research reported that an Android mobile unnamed Trojan "888.apk" intercepts and sniffs mobile banking transaction packets during SMS alerts and transaction commands such as Check, Validation, and pay as an attack banner grabbing process. Apart from the 888.apk mobile Trojan, Kaspersky reported the emergence of a new Android banking Trojan Svpeng known as Trojan-SMS.AndroidOS.Svpeng. Svpeng steals mobile banking credentials such as passwords and usernames upon launching a mobile banking application. The Trojan targeted only Russians using android phones and later people in other countries. Mobile Trojan horses are a dangerous set of mobile malware which on most occasions appear fictitious as beneficial applications but with hidden malicious content and action when executed. Some mobile Trojans can obliterate a whole mobile or computer drive when infected, while some serve as a backdoor for device remote control.
Malware writers apply the principle of social engineering as a means of gaining financial benefits from victims using SMS premium service. Through this strategy, victims subscribe to certain services or applications without their consent. Scammers usually use users' phone numbers or emails to execute this malicious scheme. Most malicious premium messages to victims seem very real and appealing such as: 'Know who blocks you on WhatsApp' 'Click here to see the message sent to you by a friend', 'Install battery speedometer to see how long your battery lasts', and 'Amazon is giving a free £25 to prime members'; click here to claim yours'. Hackers make these tricks look appealing and real to entice the victim. Once the phone number is supplied, an automatic subscription to your monthly mobile bill is activated for any SMS received or sent. For advanced SMS premium service attacks [91], the victim does not have to be tricked into giving his phone number. Hackers' banners grab the social networks account details of the victim, specifically his phone number. Therefore, it is advisable to critically look at the content of any email sent to you before opening it, especially if it looks suspicious. More importantly, it is worth not trusting easy financial claim links sent to you if not from your financial institutions such as banks and cooperatives. It is pertinent to note that the SMS premium service charge attack cannot be achieved if the malware does not have permission to access the device service "send Text Message", which is the mobile privacy permission SMS service. Hence, understanding permission requests are very significant in fighting mobile SMS Trojans.

4) Rootkit
A rootkit is a mobile malware type that controls and exploits a mobile device through remote access. A rootkit comprises a loader, rootkit, and dropper. The rootkit gains administrative access and installs other applications at the backdoor that are malicious without the consent of the victim. Rootkit alters the configurations of a device once installed. Due to their silence and underground operations, it is very difficult to identify and remove the rootkit. Evasion techniques such as obfuscation are adopted by roots to make it stay undetected in a device for a long time. HummingBad [92] is an example of a rootkit that steals credentials by installing other malicious applications in the background to create fake ads.

5) Botnets and viruses
Botnets are compromised devices whereby an attacker remotely accesses and controls the infected devices. The botmaster controls the infected mobile phones without the knowledge of the victims. Botnets have become a serious threat to information and mobile security, as attacks such as DDoS are launched using mobile botnets. Double-Door [93] is an example of a popular mobile malware botnet. Mobile viruses are small computer codes built to attack devices operating in cellular environments, such as mobile phones and PDAs. They are computer programs whose designs are borne out of curiosity to gain general attention and target and exploit vulnerable mobile phones and other applications with a high degree of versatility. A mobile virus is propagated the moment an infected file or application is executed, causing a speedy escalation to connected devices and other application segments. The ruinous consequences of a virus on mobile devices and applications range from data loss, application loss, and device destruction on most occasions, if not discovered early. Some viruses invade detection and may be difficult to be identified by traditional detection mechanisms. When the running OS of memory in a device (mobile or computer) is infected with virus code, all the programs including the executable code running in the core memory of such a device can also be infected including its internal storage Fig. 8. The virus program first requests permission from the device OS to attach its code to the device object module, especially at the system start-up. After the septic virus code is invoked in the device memory, the virus then switches over and takes over the entire system. The infected code then spreads to the device operating system. In the case of a computer, a floppy disk serves as the object code, which helps in virus invocation and execution at system start-up.

6) Worms
Android worms are malicious codes that black hackers develop for malicious intents and operations for mobile devices. Worms have the capability to self-replicate from one susceptible mobile device to another with little or no external trigger such as human behavior. Mobile worms assume different file formats, such as pdf and file extensions, to invade a vulnerable device. The peculiar infection character of worms is that the payload executes once on the initial device and later escalates to other targeted devices via attack vectors such as TCP, email, IP, SMS, etc. Based on the papers examined as part of this study, we classified mobile worms into five (5) main categories with their major characteristics (see Table III) as follows: Binary file worms: These are forms of worms that infect device executable files. They are usually programmed in machine language for easy payload distribution.
Multi-partite worms: These are worms with the capability of affecting mobile and computer boot sectors and executable files. This form of worm is rare.

Script file worms:
These are worms technically written in human-readable form, which requires translation, by an interpreter to perform machine-executable.

Binary stream worms:
The infection vector deployed by this form of worms is pure via a network connection. It relies on the device to be linked to the network before implementing its infection.
Macro worms: These are worms that infect applications and data files such as documents. Macro worms seem to be the most common. To reduce worm infections on Android devices and mobile platforms in general, it is pertinent to regularly upgrade the mobile OS to the latest versions to avoid mobile susceptibility to signature-based and zero-day attacks. A summary of the malware classes and their distinct but related behavior is presented in Table III.
The use of the latest antivirus engines is very significant, but it is recommendable to ensure that the latest mobile device patches are constantly installed and updated. By this, the worm infection rate and worm propagation can be considerably reduced. This strategy is essential, because our research believes that the worm's infection rate on mobile devices is directly proportional to the propagation speed. An increase in worm removal on affected devices can also subdue its propagation, thus reducing the number of mobile devices that can be contaminated. Other types of Android malware include Spyware and key loggers. Android OS fragmentation and open source have created security loopholes resulting in the great increase in attacks we are seeing now. Apart from the entire android platform, the majority of the android applications have untrusted digital signatures within their security parameters. While Apple has a proactive approach to malware and general threats, Google is more concerned about taking reactive defense approaches when a threat occurs. In addition, while iOS sticks to Xcode [94] Analysis of Mobile Malware: A Systematic Review of Evolution and Infection Strategies  [95] affirmed that two-thirds of mobile malware targeted Android platform devices. This shows the degree of android vulnerability to malware. It, therefore, calls for appropriate security strategies to address this problem timely.

Iv. MoBIle Malware InfectIon vectors
Infection strategies are attack vectors through which designed mobile malware access the target device to execute their payload. Malware files remain non-executable and uninfected, until a path is created via which access to the device could be achieved. While malware was written earlier, its propagation rate was slow compared to recent malware. The speed of malware propagation is significantly enhanced by internet advancement. Internet connectivity is one of the major routes via which malware payloads are easily transmitted to other subsidiaries such as Bluetooth, SMS, cellular networks, Wi-Fi, physical access, and USB-PC connections.

A. Bluetooth/SMS distribution
Mobile malware such as Commonwarrior was discovered in 2005 and spread through Wi-Fi and SMS as an attack vector. As cited in Fig 9, mobile malware spreading through this medium has a large spectrum of infecting an entire continent, since there is nothing to restrict the spread except the exhausted balance of the user's device. Pebler mobile is known to infect mobile phones by exploiting vulnerabilities found in Wi-Fi and network connectivity to devices. The only limitation of this attack vector is that mobile devices with no internet features suffer little. As technology advances, mobile devices with embedded Bluetooth technology can communicate and share files with nearby devices, which are a few meters away. Some Trojans exploit Bluetooth to spread to other devices. The danger of this attack vector is that although it can only infect nearby devices, it can cause a devastating septicity where many Bluetooth devices are enabled [96].
Bluetooth attack vector has a high threshold of spreading malware since the majority of mobile users share mobile files such as pictures, videos, and audio files without considering the consequences. Advancement in Bluetooth technology to enhance the location down to centimetre-level precision has created and expanded mobile malware propagation conduit. For instance, the inclusion of a point of interest application (POI) [97] for information solutions enhances the speedy replication of worms using Bluetooth. SMS is another mobile malware distribution strategy where malware payload is being disseminated to mobile or devices through SMS or MMS. The propagation could either be through sending SMS or MMS from one mobile device to another or from the cloud to the mobile device. Malware uses SMS as a distribution attack vector to mobile devices where the target device is infected to send illegal and unauthorised texts, and the victim is directly charged for the call or text message.

B. USB/network to device distribution
Apart from the Bluetooth infection strategy, USB is one of the distribution strategies. Different developers upload and update their malicious codes on the Apps store, camouflaging them as genuine software. When the user installs a malicious application, malware unknowingly infects the user's device. When mobile devices connect to PCs through USB, this offers the opportunity for a malware-infected PC to transmit to the victim's device. The attack vector serves as a thumb drive for PC-Mobile malware infection. This is where malware is distributed from Universal Serial Bus (USB) to any device, which could be PCs and mobile devices. As was announced by IBM, many USB sticks with the following product model "2071, 02A and 10A are infected with malware which has access to the device via USB cables or port when a connection is established between the USB and the device. When a mobile device is connected via a USB port to an infected computer, malware distribution to the phone becomes inevitable. This distribution technique is used by malware in the form of ads or applications connected to the internet and masquerading as real applications.

C. Market/application to device distribution
Application to Device known as A2D is a distribution mechanism where the mobile malware depends solely on the application vulnerability to distribute itself. An example of android malware, which exhibits spreading and infection vector via A2D approach, is Andr/Opfake [98]. In the Market to Device strategy in distributing malware, a malicious application is uploaded into the application store market. The infection by users is dependent on the application reception in the market and user's installation on their mobile phones. On a general note, some of these infections happen when users make conscious resolutions to carry out an act. Behavior like scanning barcodes, QR codes, or logging into an unsecured compromised Wi-Fi network is an example that led to users' mobile devices to be exploited by malware.
In summary, we assume a malware type could infect a susceptible mobile device after effective communication with a contagious device if an im-munity to that same type of malware is not developed. Based on the meta-analysis of the infection strategies, we assume that when a mobile device becomes infected, it can develop immunity to that same type of malware and can recover if adequate security strategies are applied immediately. However, such a device will remain vulnerable to other variants of the same malware after recovery. Also, an infected device has the capacity to spread the malware if not kept under control.
v. classIfIcatIon of sMart Malware Based on BehavIoral Different criteria are used in classifying mobile malware such as classification based on device-platform [99], [100], family [101], file system [102], resource consumption [103], and many other criteria. Our research uses behavioral attributes as a major classification criterion of mobile malware. Under behavioral attributes, our research focused mainly on privilege escalation and attack goals as discussed in the subsection.
Malware privilege escalation has attack goals. For instance, people downloading pornographic files do so to gratify their carnal urges, just like those who indulge in online provocation and harassment do so to have power over the other party. In addition, just like any other cybercrime, the goals behind every cybercrime are financial incentives, power greed, adventure, and vengeance. Some malicious activities on mobile devices are to steal sensitive personal credentials, while others are for SMS premium where charges are made without embarking on any service or SMS by the user unknowingly.

A. Classification based on privilege escalation
Privilege means what a device user is allowed or permitted to do on such a device. Examples of such include file editing or modifications. In the context of our research, it is viewed as the art of malware exploiting a vulnerability, bug, configuration, or design flaw of a mobile device or application to have enough unauthorized privileges to access mobile resources. When this occurs, malware reads and writes to files, may insert or attach a permanent backdoor see Fig. 10.
Malware exploits some strategies to gain the required privilege. Some of these strategies could be user manipulation or technical exploitation. The technical exploitation path usually followed by malware to gain escalated privilege to mobile devices is through platform misconfiguration or technical susceptibility. Malware technical exploitations modify the security restrictions of a device. Once this is accomplished, exploiting other vulnerabilities on the affected system becomes very easy. This technical exploitation malware imbibes to achieve privilege escalation including buffer overruns, session attacks, SQL injection, cross-site attacks, file disclosure system vulnerability, and networking configuration flaws.
The attack behavior and goals include sabotage, spam, and service misuse. This analysis clearly shows that mobile malware displays different behavioral sets. It is worthy to note that the mobile malware attack goal has different categories of incentives, which are interwoven. It means that an attack goal can have more than one motivation. For instance, SPAM as an attack goal has both personal information theft and financial profit as motivation types.

B. Classification based on attack goals
Though malware keeps evolving to take different attack trajectories, their attack goals and motivations remain the same (see Fig. 11). While some malware writers could focus on stealing sensitive information as a primary step upon which subse-quent attacks could be relied upon, others focus on the actual attack goal in their code implementation. Our research classified mobile malware attack goals based on their motivation type and behavior related to the motivations. Table IV shows the motivation types and major attack goals classified in our research. Cybercriminals perform attacks to achieve one form of intention or the other. This means that for every attack, there is an equal motivation behind it. Just as malware writers develop malicious applications for different motives such as financial profit, identity theft, industrial espionage, and a host of others, people that use these applications also have motives behind their usage. Based on their characteristics, mobile malware deploys different infection strategies based on the attack goals.
We observed that the motivations behind every mobile attack are different: financial, power, greed, adventure, and vengeance. While some malicious activities on mobile devices target sensitive personal credentials, others are for SMS premium where charges are made without embarking on any service or SMS by the user unknowingly. The attack behavior and goals include sabotage, spam, and service misuse. These are pure types of motivations for mobile malware attacks.
The attack schemes that formed the behavior related to those motivations could include eavesdropping, profiling, and loggers. Kocher et al [104] show how to pattern malicious behavior using security inspection  strategies. This confirms that mobile malware exhibits different attack goals during execution. It is worthy to note that mobile malware attack goals have different categories of motivations, which are interwoven. This means that an attack goal can have more than one motivation. For instance, SPAM as an attack goal has both information theft and financial profit as motivation types.
The unusual behavior of an application should be reported promptly. During application download and installations, mobile application plugins and codecs are pointers to be observed that the app is from a legitimate store. Mobile users could deploy software solutions from Enterprise Mobility Management to enhance the security on enterprise devices. These security strategies could help reduce the impact of the rising mobile malware threats.

vI. conclusIon
Malware attacks on mobile devices are increasing with the increase in the number of mobile applications published on the App and Play store daily.   For instance, the first-generation mobile malware could not spread quickly due to low knowledge of wireless hacking, short Bluetooth range coverage, a small Wi-Fi network population, and the lack of cross-platform propagation. Other factors that enhance the spread of mobile malware include advancement in threat dimensions, improved security, and business communication on Tor using multi-signature transaction and encryption approach, mobile platforms' integration with the IoT-based applications, the emergence of evasion techniques, and the advancements in mobile malware Toolkits on the dark web. To achieve the aim of the paper, we conducted an up-to-date study of mobile malware evolution and infection strategies. This enabled us to classify mobile malware evolution trends into distinct categories based on their sophistication, characteristics, and attack intents. We identified factors that limited the fast spread of the early mobile malware such as lack of mobile OS standardization, lack of mobile OS cross-platform, and lack of Bluetooth technological advancements in data communication. Finally, we identified factors that enhanced the fast spread of recent mobile malware. These included the advancement in threat dimensions, improved security and business communication on Tor using a multi-signature transaction and encryption approach, mobile platforms' integration with the IoT-based applications, the emergence of evasion techniques, and the advancements in mobile malware Toolkits on the dark web.
Furthermore, this paper has discussed research conducted from 2000-2020 on mobile malware evolution with their infection strategies. In the end, the paper identifies the need to analyse the existing detection techniques to identify their strengths and weaknesses to help develop more robust and accurate tools for an Android malware detection standpoint. We suggest the need for a malware infection model to prevent mobile malware spread among mobile platforms with random additive perturbations of infection rate. This strategy will help to understand the immunity state of a mobile device during and af-ter recovery from malware infection. The effect of the random perturbation on malware stability behaviour might be essential in determining some transient characteristics of malware infection states.