So Your CFO's Phone Has Been Pwned: A DFIR Journey

This article uses two hypothetical SOC incidents—an Android banking trojan (ERMAC/HookBot) and an iPhone compromise involving a DarkSword iOS exploit chain and credential-phishing—to demonstrate mobile incident response: preserve devices, gather APKs/network telemetry, pivot on IOCs to historical infrastructure using Censys, and expand scope across the enterprise while converting findings into durable detections.