How a humanitarian tool got me flagged as a malware author
by Ringmast4r · Church of Malware ✠ Scripture

2026-04-28

There's a line on this very site, courtesy of 0x12darkdev, that reads:

"Malware is not the enemy. Ignorance is..."

I want to take that line out for a walk.
Because last week I lived inside it.

The Ask That broke The Filter :

I was building a mobile web app. The use case is narrow and unsexy on paper: let a user fetch the contents of an app without installing the app on their device. A headless wrapper. No icon on the home screen. No package in the app drawer. No telltale bundle ID for a checkpoint guard to scroll past and stop on.

I asked an AI assistant to help me work out the headless flow. Mid-session, the response stopped cold and the API spit back a policy-violation error. Translation: the model's safety layer had decided, with zero context about who I was, who the users were, or what country they lived in, that I was building a surveillance tool. Or malware. Or both.

And from a pattern-matching standpoint, fair enough. "Download an app's contents without the app being present on the device" reads like a stalkerware spec sheet if you squint hard and read fast. The filter squinted. The filter read fast. The filter ruled.

Here is what the filter did not know.

The Use Case The Filter Could Not See :

I have friends and contacts living in regimes where the police, the military, or some flavor of morality-enforcement squad will physically stop you on the street, demand your phone, and scroll through your installed apps. If they find a Western messenger, a VPN, a news reader, a dating app, a translation tool with the wrong language pair, a queer community app, a women's-health tracker, a religion-of-the-wrong-flavor app, the consequences range from a beating to a "disappearance" to a prison sentence.

The threat model is not "what's in your messages." The threat model is "is the icon on your phone."

So the protective design is obvious once you've talked to the people living it: don't put the icon on the phone. Let the user reach the functionality through a web layer that leaves no installed footprint, no listed package, no recoverable trace under a one-minute checkpoint scroll. The phone, when seized, looks like a phone with a browser. Because that's what it is.

That is not malware. That is a life-jacket.

But to a policy filter trained on the worst-case interpretation of every verb in the security dictionary ("headless," "download," "without the app," "background," "wrapper"), it parses identical to a stalkerware vendor's pitch deck. The filter cannot see the user. The filter cannot see the regime. The filter cannot see the bruises. The filter sees verbs.


Want to read more? Follow the link below to the official blog post: 

https://churchofmalware.org/articles/ignorance_is_the_enemy_txt