Mobile applications have become the frontline for API-based attacks, exposing enterprises to escalating risks of fraud and data theft, according to new research from Zimperium.
The study found that one in three Android apps and over half of iOS apps leak sensitive data, leaving critical business systems exposed. Unlike web apps, mobile apps ship API endpoints and calling logic directly onto untrusted devices, where attackers can reverse-engineer code, tamper with apps, intercept traffic, or use compromised devices to send malicious API calls that appear legitimate.
Zimperium’s analysis underlines the scale of the threat:
- API exposure inside apps – sensitive data leakage in 33% of Android apps and more than 50% of iOS apps.
- Client-side tampering – widely available tools allow attackers to intercept and alter API calls.
- SSL pinning blind spots – nearly one-third of Android finance apps and one-fifth of iOS travel apps remain vulnerable to man-in-the-middle attacks.
“APIs don’t just power mobile apps, they expose them,” said Krishna Vishnubhotla, vice president of product solutions at Zimperium. “Traditional security tools can’t stop attacks happening inside the app itself. Protecting APIs now requires in-app defences that secure the client side.”
To close the gap, Zimperium urges enterprises to adopt two key approaches: API hardening, which shields endpoints, tokens, and logic through obfuscation and runtime defences; and app attestation, which verifies that every API call comes from a genuine, untampered app running on a trusted device.
