A financial technology firm in Atlanta, Georgia launches an internal investigation after multiple employees report...

The correct answer is B. Agent Smith.

Agent Smith is an Android malware family known for abusing infected applications to silently replace legitimate installed apps with malicious versions. After replacement, the compromised apps can display fraudulent advertisements and collect or transmit user-related data.

CEH-aligned mobile security material explains that mobile malware targets mobile devices to steal personal data, and that installing applications from untrusted sources increases the risk of malware intrusion . It also explains that Android applications consist of components such as activities, services, broadcast receivers, content providers, and manifest files, which malware can abuse to run background behavior and interact with other applications .

Option A. GoldPickaxe is incorrect because GoldPickaxe is associated with mobile banking and identity-related theft activity, not the classic app-replacement and ad-fraud behavior described.

Option C. Pegasus is incorrect because Pegasus is advanced spyware focused on surveillance and data extraction, not primarily replacing installed apps to generate advertisements.

Option D. Mamont is incorrect because Mamont is associated with Android banking/social engineering fraud activity, not the described app-replacement adware behavior.

Therefore, the best answer is B. Agent Smith.