I have no idea how these attacks work, I've only seen the results. Probably you would want to look at the code that creates the mobile landing page to start with.