Digital Forensic Analysis Of APK Files In Phishing Scams On Whatsapp Using The NIST Method

Abstract

Cybercrime targeting Android devices through phishing methods, especially through the WhatsApp messaging app, has emerged as a critical issue in cybersecurity. It requires comprehensive investigation and analysis. This research attempts to address this critical issue by conducting a comprehensive digital forensic investigation using the National Institute of Standards and Technology (NIST) framework methodology. Using advanced reverse engineering techniques and Vscode's APKTool extension tool, called APKLab, the research carefully examines the structure and mechanism of hidden encoded APK files that aim to steal sensitive information, such as SMS messages containing one-time passwords (OTPs), and send them via the Telegram app to attackers who can use them to access personal and banking data. As a result, this research provides a deeper understanding of the cybersecurity threats to Android devices and suggestions for mitigation measures for users and organizations. The recommendations are consistent with NIST principles. They emphasize the importance of user education, application source code reviews, system updates, and considering the use of additional security software. By filling an important gap in digital forensics, this research aims to provide insight into preventing and mitigating phishing scams via APK files on WhatsApp Android. It also highlights the importance of strong cybersecurity measures and encourages continued research efforts to effectively counter emerging cyber threats.