CITT

    Scan results

    Malwarebytes - Mobile Security

    Android

    Malwarebytes Mobile Security offers antivirus protection, malware removal, real-time threat detection, VPN for secure browsing, anti-phishing alerts, and scam identification. Trusted by millions globally for comprehensive mobile device protection.

    CITT SCORE
    60
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Users comfortable with analytics tracking their usage

    Not For: You prefer tools that don't share data with marketers

    What It Means For You

    App usage and behavior is tracked by AppsFlyer and Amplitude for marketing and analytics purposes. Firebase collects performance and session data, and Sentry captures crash details from the device. Subscription activity is shared with RevenueCat and Iterable for marketing communications.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (10)

    Data Security

    4 total
    1 High
    1 Medium
    2 Info

    Network Security

    1 total
    1 Critical

    Code Security

    2 total
    2 Info

    Privacy

    3 total
    2 High
    1 Medium

    Third-Party Services

    AppsFlyer, Amplitude, Firebase Analytics, Firebase Crashlytics, Firebase Performance, Firebase Remote Config, Firebase Cloud Messaging, Firebase Sessions, Sentry, Iterable, RevenueCat, SQLCipher, Apollo GraphQL, WireGuard, Mullvad VPN

    Security Strengths

    • ✓SQLCipher 4.10.0 encryption for security databases
    • ✓No JavaScript interfaces in WebView (zero RCE vectors)
    • ✓FLAG_SECURE screenshot protection
    • ✓Comprehensive WebView file access lockdown
    • ✓Room ORM SQL injection prevention
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    security
    privacy
    vpn
    analytics
    sensitive data
    third party tracking
    subscription

    Package

    org.malwarebytes.antimalware

    Version

    5.20.0+505 (versionCode: 52000505)

    Analysis Date

    Feb 1, 2026

    Classes Analyzed

    16,284

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (1 high, 1 medium, 2 info)

    Network Security - 1 finding (1 critical)

    Code Safety - 0 findings

    Privacy - 3 findings (2 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    • App usage patterns and in-app behavior collected by AppsFlyer and Amplitude
    • Performance metrics, session activity, and app health data collected by Firebase
    • Crash details and device diagnostics collected by Sentry and Firebase Crashlytics

    Third-Party Data Sharing

    • AppsFlyer - Usage and install behavior is shared for marketing attribution
    • Amplitude - In-app actions are shared for analytics and product decisions
    • RevenueCat - Subscription and purchase activity is shared for billing management
    • Iterable - Subscription status is shared for marketing communications

    Understanding the Scores

    CategoryScore
    Security65/100
    Privacy55/100
    Data Security75/100
    Network Security50/100
    Code Safety100/100
    Data Collection60/100
    Data Sharing65/100
    User Control100/100

    Positive Security Features

    • Code Safety rated 100/100, indicating no detected unsafe coding patterns in the app
    • User Control rated 100/100, giving users full authority over app permissions on the device
    • Local data on the device is protected using encrypted storage

    Areas for Improvement

    • The app shares data with a higher-than-expected number of marketing and analytics services for a security-focused tool
    • Network communication practices could be strengthened to better protect data moving between the app and external services
    • Data collected by third-party analytics partners extends beyond what is needed to deliver the app's core protection features

    About This Analysis

    This scorecard is based on static analysis of the app's code and observed behaviors. Scores reflect practices at the time of the scan and may not capture every possible risk or subsequent updates.

    App Details

    • App Name: Malwarebytes Mobile Security
    • Package ID: org.malwarebytes.antimalware
    • Version: 5.20.0+505 (build 52000505)
    • Scan Date: 2026-02-01
    • Analysis Platform: canITrustThat

    Right of Reply

    Developer not yet contacted