I recently started thinking about an attacker which would clone a mobile application, and add some code which would do something malicious, e.g. credential theft. This cloned app would communicate with a legitimate server and therefore offer a legitimate service to the user.
On the web this is solved by relying on user to check the URL, but also with protections like CORS.
I am wondering how the mobile attack variant can be prevented on the server side. First thing that comes to mind is using some form of credentials. However, with enough effort, this be broken with reverse engineering.
Can you think of anything better or more reassuring?