Abstract

Proxies, VPNs and Tor have long helped the privacy community and users in censored regions to fight censorship. However, the same tools can be maliciously exploited by malware and botnets to conceal their communication to external command and control servers. Despite being a critical concern fueled by the proliferation of malware based attacks, no longitudinal studies have analyzed how malware applications use covert channels (CC) to evade detection. We fill this gap by performing the first study of the usage of covert channels in the Android malware ecosystem. To that end, we develop a complex multistage pipeline that combines static and dynamic analysis to investigate both system and network-level features. We applied this pipeline on a corpus of 3.5M Android malware spanning 2009 to July 2025 (one of the largest sample for such a study). Our carefully crafted static validation rules uncovered 288K APKs that used CCs spanning 511 malware families and CC usage growing exponentially from 0.30% (2012) to 50% (2025). The dynamic execution of a subset of these applications on physical mobile phones not only confirmed the results of static analysis based results but also enabled a deeper analysis. Overall, we identified 19,308 unique IP addresses being contacted in 85 countries, out of which we were able to explicitly validate the presence of CCs for 59 IP addresses across 17 countries. Further, we performed a longitudinal dataset study spanning over 16 years for CC based malware and found that CC usage has evolved, e.g., some malware adopted by using more than one CCs (one family used more than 5 CCs); others switched between them periodically (one family switched CC usage 40 times from 2019 to 2025). Lastly, we tested two state-of-the-art malware detection solutions on CC-based malware identified in our work. We found that they fail miserably, yielding high false rates (> 50%), underscoring the need to consider the effect of CCs on malware detectors. Overall, we believe that our work advances the communitys understanding of CC based malware and lays the groundwork for future studies to consider CC usage when developing malware detectors.