A method for recovering malfunction of at least one resource of a mobile device in response to a malware attack and a mobile device thereof. The method comprises diagnosing at least one malfunction of at least one resource of the mobile device without identifying a reason of the attack, and, in response to said diagnosing, recovering at least one resource of the mobile device. The mobile device comprises one or more resources operatively coupled to at least one sensor directly or indirectly coupled to a recovery block, wherein said sensor is configured to monitor at least one of said resources for information, possibly indicative of at least one affected resource, and to report, directly or indirectly this information and/or derivative thereof to the recovery block; and said recovery block is configured to initiate at least one recovery-related action in respect of at least one of said resources in case the received information and/or derivative thereof meets a certain criterion.