Phantom Squatting - Malicious APK Delivery via HTTP Content-Type Header

Duo Tech@duotech

•updated Jul 1, 2026•0•0•3

This rule detects HTTP responses that return an Android Package (APK) file (application/vnd.android.package-archive) to a client. This is indicative of potential mobile malware delivery or unauthorized application distribution.