Mobile Security
How to detect Frida hooking
on Android
Frida lets an attacker inject scripts into a running app to rewrite its behaviour. Apps can detect many common setups by checking processes, memory maps and hooked functions, but the checks run on a device the attacker controls, so detection must be verified on the server.
What is Frida hooking?
Frida lets an attacker run JavaScript inside your app's process while it is running. From there they can replace functions, so a "device is rooted" check can be made to return false, or a payment confirmation can be altered. NPCI's mobile app security circular names dynamic instrumentation toolkits such as Frida, Cycript and Ghidra as something UPI apps should not run alongside. NPCI circular →
How do apps detect Frida?
Common detection techniques include:
- Looking for the frida-server process or its default listening port (27042).
- Scanning the app's own memory map for Frida agent libraries.
- Checking for characteristic thread names created by the Frida runtime.
- Verifying that sensitive functions have not had their opening instructions overwritten (inline hook detection).
- Comparing the app's code and signature against known-good values at runtime.
Why detection alone is not enough
Every one of those checks is client-side, and the attacker controls the device. A renamed frida-server, a different port or a patched agent defeats the simple versions. Detection also tells you nothing if the check itself is hooked and made to report "clean".
Practical defences layer several things: multiple independent checks, integrity checks on the checks, signals signed on the device and verified on the server, and hardware-backed attestation so the server can tell when a device cannot prove it is genuine.
What a stronger approach looks like
Treat Frida detection as a risk signal, not a verdict. Feed it into a score with device, behaviour and network signals, decide the response (allow, step up, block) on the server, and keep a signed record of what was found. More on mobile RASP → · Case study: kernel-level hijack stopped by RASP →
Frequently asked questions
What is Frida?
Frida is a dynamic instrumentation toolkit that lets someone inject scripts into a running app to inspect and change its behaviour. Security researchers use it legitimately; fraudsters use it to bypass checks inside banking apps.
Can an app reliably detect Frida?
An app can detect many common Frida setups, but a determined attacker can rename or modify the tooling. Detection should be one signal among several and should be verified on the server rather than trusted from the device.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.