Executive Summary
In October 2026, NICT's LETTICE team and JPCERT/CC issued alerts regarding a surge in 'A2B Attacks' (App-to-Backend Attacks) affecting Japanese organizations. Attackers obtain publicly available Android and Flutter APK files, reverse-engineer them to identify hidden API endpoints and authentication mechanisms, and then launch direct attacks against the backend infrastructure.
A key finding is that these breaches occur even when the mobile application itself lacks vulnerabilities, as the attackers target flaws in server-side authorization and input validation. The integration of AI for automated vulnerability discovery and APK analysis (e.g., extracting strings from libapp.so) is significantly lowering the barrier for entry and increasing the scale of these attacks.
This trend represents a critical shift from generic product scanning to target-specific API exploitation. Affected sectors include any organization publishing public mobile applications, with a high impact on personal data security and internal system integrity.