Sophos Intercept X for Mobile is a security app for Android phones and tablets and for iPhone and iPad. It checks apps, settings, Wi-Fi networks, links and QR codes for threats, and it includes a one-time password generator for multi-factor sign-in. Individuals can use it free without management. Organizations license it and run it through Sophos Mobile. Features differ between Android and iOS.
Scanning Android apps for malware
On Android, Intercept X for Mobile scans every app as it is installed and compares it with SophosLabs threat data. Online checks use the SophosLabs cloud database, and a built-in engine keeps detection working offline. Scans can also run on a schedule or by hand. The user can check an APK file before installation by sharing it from a file manager to Intercept X. Settings can add system apps, SD cards and USB storage to scans, and can monitor external storage so new files are scanned as they arrive.
Results can include malicious apps, potentially unwanted apps (PUAs) and apps with a low reputation in Sophos Live Protection data. Each detection opens a details page showing how the app was installed, the permissions it requested and a threat description. The user can uninstall the app or allow it. Allowing it moves it to an exclusion list the user can edit later.
Settings and permission checks
Device Security on Android reviews system settings that affect safety. The app marks each one green for secure or red for insecure with a fix recommendation. Yellow means the app cannot judge the setting on that model or Android version. Gray means the check is off and does not count toward the overall status. On iOS, the same section shows the device model and iOS version, recommends available updates and reports a detected jailbreak.
The Android Privacy Advisor lists which apps requested permissions in the groups Google treats as dangerous, such as Camera, Contacts, Location, Microphone and SMS. Each permission shows as granted or denied. Tapping an app leads to the system page where the user can change its permissions. A change history, filters and sorting help when reviewing many apps.
Wi-Fi attack detection
Wi-Fi Security in Sophos Intercept X for Mobile checks the connected network on both platforms. It looks for ARP spoofing that redirects traffic to an attacker and SSL interception with forged certificates. It also looks for SSL stripping that downgrades HTTPS to plain HTTP, and for manipulated web content. It also reports captive portals on public hotspots because they redirect all traffic. A check can run by hand or automatically each time the device joins a network. Android requires location permission for this feature. On iOS, the user can hide issues per network, and the app cannot detect ARP spoofing on current iOS versions.
Web filtering and link checking
On Android, Web Filtering covers Chrome, Firefox, Edge and the Android browser through the Sophos accessibility service. The user chooses Warn or Block for malicious sites and for each content category, and can always allow a page that triggers a warning.
Link Checker handles links opened from other apps, such as mail or a PDF viewer. Intercept X becomes the default browser app, checks each link, then passes it to the browser the user picked. Apps that open links internally bypass the check unless set to use the browser.
On iOS, the managing organization switches on Web Filtering and Message Filtering. Web Filtering applies in Safari, other browsers and app connections, and the user can add flagged pages to an allow or block list. Message Filtering checks incoming SMS and MMS for phishing URLs and moves suspicious messages to an SMS Junk tab. Known contacts are never treated as spam, and iMessages are not filtered.
Locking apps on Android
App Protection requires a pattern, PIN, password or fingerprint before selected apps open. A grace period sets how long the unlock lasts. It needs device administrator rights. The user can also lock apps that could be used to uninstall or disable the protection, as well as Google Play and other installers. A companion Guard app restarts the protection if a task manager stops it. App Protection is unavailable when Sophos Mobile manages the app.
Authenticator and QR Code Scanner
The Authenticator generates time-based and counter-based one-time passwords for multi-factor sign-in. Time-based codes show a countdown to the next code, and counter-based codes refresh on demand. The user can copy codes and rename or delete accounts, but cannot view the stored secret key.
The QR Code Scanner checks web addresses against SophosLabs classifications before opening them. It saves vCard contact cards, and on Android it can also dial, email or map them. For Wi-Fi codes it warns when a network lacks WPA or WPA2 security. Android joins the network directly, while iOS copies the password for Settings.
Management through Sophos Mobile
When Sophos Mobile manages Intercept X for Mobile, the organization sets its configuration, can start security checks remotely and tracks device compliance. A non-compliant device can lose access to the network or other resources. The app dashboard shows the compliance status.
