How to Detect Hooking (Frida) on Capacitor

Protect your Capacitor app from runtime attacks like Frida and Xposed with smart detection.

DIY Coding GuideImagine your app’s security is a locked vault. What if an attacker could pick the lock and alter its contents while it’s actively being used? That is exactly what a hooking attack does.

This runtime threat is uniquely dangerous for hybrid frameworks like Capacitor. Because Capacitor relies on a communication bridge to pass data between the web layer (WebView) and Native code (Java/Swift), there are multiple points of entry for attackers to intercept data, manipulate logic, or extract API keys.

What is Hooking?

Hooking allows malicious actors to inject their own code into your running process using dynamic instrumentation toolkits like Frida. It’s akin to wiretapping a phone line: the attacker sits between the operating system and your app logic, listening to every instruction and modifying them at will.

This grants them the ability to:

• Nullify Defenses Instantly turn off jailbreak checks, SSL pinning, or biometric requirements.

• Siphon Secrets Capture unencrypted API tokens, passwords, or JWTs right from system memory before they are stored or transmitted.

• Alter Logic Rewrite the return values of your functions (e.g., forcing a checkPaymentSuccess() function to always return true).

How common is hooking?

About 0.05% of devices are hooked. If your Capacitor app manages payments, PII (Personally Identifiable Information), or competitive gaming logic, you are a target.

Number of Hooked Devices (source: Talsec)

Check out our live global stats at my.talsec.app

How to Detect Hooking?

Capacitor developers often face a "sandbox" problem. The JavaScript environment where your Ionic/Angular/React code lives has no visibility into the low-level operating system processes. You cannot ask the browser window if the kernel is being tampered with.

To detect these threats, you must leave the web layer and implement checks within the Native Android/iOS layer.

DIY Coding Guide

Since you cannot detect hooking from index.ts, you would need to build a custom Capacitor Plugin. A common "Do It Yourself" method involves scanning for network ports typically associated with the Frida server.

Here is what that logic looks like in the Java layer of a custom plugin:

// Android (Java) logic inside a custom Capacitor Plugin
private boolean isFridaServerRunning() {
    // Frida default ports
    int[] suspiciousPorts = {27042, 27043};
    
    for (int port : suspiciousPorts) {
        try {
            // Attempt to connect to the local port
            Socket socket = new Socket("127.0.0.1", port);
            socket.close();
            // If we connected, something is listening there -> Danger
            return true; 
        } catch (IOException e) {
            // Port is closed, usually safe
        }
    }
    return false;
}

Use freeRASP (free library by Talsec)

Instead of building custom plugin, can use freeRASP. It provides a multi-layered shield that runs deep in the native code, protecting your Capacitor bridge from the inside out.

• Deep Inspection: It monitors for suspicious libraries, memory tampering, dynamic code injection, and process anomalies—not just open ports.

• Resilience: Designed to detect when it is being tampered with (anti-tamper checks).

• Offline First: Does not require an active internet connection to protect the device.

• Comprehensive Suite: Includes 14+ threat vectors (Root, Jailbreak, Emulator, Debugger, Screen recording, etc.).

• Battle Tested: Currently protecting over 6000+ apps globally.

Integration Example

import { startFreeRASP } from 'capacitor-freerasp';

// reactions for detected threats
const actions = {
  // Android & iOS
  privilegedAccess: () => {
    console.log('privilegedAccess');
  },
}

const config = ...

// returns `true` if freeRASP starts successfully; you can ignore this value
const started = await startFreeRASP(config, actions);

Commercial Alternatives

When evaluating mobile app security and Runtime Application Self-Protection (RASP), developers often compare various Talsec alternatives to find the right fit for their architecture. The "right choice" depends on the specific problem you need to tackle and which vendor offers the best bang for your buck.

The market is diverse, offering different philosophical approaches to protection. Talsec prioritizes top-tier root detection and a balanced security SDK portfolio covering the most popular attack vectors. Meanwhile, some vendors specialize primarily in heavy code obfuscation and compiler-based hardening, while others focus on a drag-and-drop (no-code) integration experience for DevOps-oriented teams. There are also solutions dedicated specifically to API security, active cloud hardening, enterprise compliance, or gaming protection. The most prominent providers alongside Talsec include Guardsquare, Appdome, Promon, Build38, Approov, and AppSealing.

Key Takeaway

Hooking is a sophisticated attack vector that renders standard encryption and local storage protections useless by modifying your app's behavior in real-time. freeRASP bridges this gap, offering a free, enterprise-grade security layer that watches for Frida, rooting, and tampering, allowing you to secure your hybrid app with native-level confidence.

👉 Secure your hybrid app today against hooking, rooting, and debugging with the freeRASP Capacitor Plugin.

Handle App Security with a Single Solution! Check Out Talsec's Premium Offer & Plan Comparison!

Plans Comparison

https://www.talsec.app/plans-comparison

Premium Products:

• RASP+ - An advanced security SDK that actively shields your app from reverse engineering, tampering, rooting/jailbreaking, and runtime attacks like hooking or debugging.

• AppiCrypt (Android & iOS) & AppiCrypt for Web - A backend defense system that verifies the integrity of the calling app and device to block bots, scripts, and unauthorized clients from accessing your API.

• Malware Detection - Scans the user's device for known malicious packages, suspicious "clones," and risky permissions to prevent fraud and data theft.

• Dynamic TLS Pinning - Prevents Man-in-the-Middle (MitM) attacks by validating server certificates that can be updated remotely without needing to publish a new app version.

• Secret Vault - A secure storage solution that encrypts and obfuscates sensitive data (like API keys or tokens) to prevent them from being extracted during reverse engineering.