Information hiding techniques can implement covert channels, which are increasingly used for developing malware that is able to bypass the security layer of modern mobile devices or to covertly exfiltrate data. For this reason, understanding and detecting this type of threats is crucial to assess the security of modern devices and data. Unfortunately, the detection of information hiding-capable malware is a complex and poorly generalizable task, as it is tightly coupled with the specific implementation. Therefore, this chapter proposes to prevent the exfiltration of mobile data by early detection of malicious software considering the correlation of processes running on a device or anomalies in the consumed energy.