1. Home
  2. Techniques
  3. Mobile
  4. Deliver Malicious Application via Other Means

Deliver Malicious Application via Other Means

Adversaries may direct victims to download malicious applications via ways that avoid an authorized application store (e.g. Google Play Store or Apple App Store). For example, victims may be directed to downloading a malicious APK directly from a domain. Adversaries may wish to avoid placing malicious applications in an authorized application store due to increased potential risk of detection or other reasons.

Delivery methods for malicious applications include:

  • Spearphishing Attachment: including the mobile application package as an attachment to an email
  • Spearphishing Link: including a link to the mobile application package within an email, text message (e.g. SMS, iMessage, WhatsApp, etc.), web site, QR code, or other means.
  • Third-Party Application Store: installing the mobile application package from a third-party application store, as opposed to an authorized app store that the device implicitly trusts as part of its default behavior. Third-party application stores may not apply the same level of scrutiny to applications as enforced by an authorized application store.[1][2][3]

Some Android malware comes with functionality to install additional applications, either automatically or when the adversary instructs it to.[4]

ID: T1476
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
ⓘ
Tactic: Initial Access
ⓘ
Platforms: Android, iOS
ⓘ
MTC ID: AUT-9, ECO-13, ECO-21
Version: 2.0
Created: 17 October 2018
Last Modified: 03 September 2026
Version Permalink

Procedure Examples

ID Name Description
S0440 Agent Smith

Agent Smith has been distributed through the 9apps application store.[5]

S0304 Android/Chuli.A

Android/Chuli.A has been delivered via a spearphishing message containing a malicious Android application as an attachment.[6]
S0524 AndroidOS/MalLocker.B

AndroidOS/MalLocker.B has been distributed using direct download links.[7]
S0422 Anubis

Anubis has been distributed via a phishing link in an email.[8]
S0540 Asacub

Asacub has been delivered via phishing SMS messages that contain a link to a website that hosts the malicious APK file.[9]
G0097 Bouncing Golf

Bouncing Golf has delivered GolfSpy via a hosted application binary advertised on social media.[10]

S0432 Bread

Bread has the ability to install additional applications.[11]
S0480 Cerberus

Cerberus has been delivered to the victim device via websites that prompt the user to "[…] install Adobe Flash Player," downloading the malicious APK to the device.[12]
G0070 Dark Caracal

Dark Caracal has distributed Pallas via trojanized applications hosted on watering hole websites.[13]

S0507 eSurv

eSurv has been distributed via phishing websites with geo-restrictions that allow access to only Italian and Turkmenistani mobile carriers. eSurv also has the ability to install applications via malicious iOS provisioning profiles containing the developer’s certificate.[14]
S0522 Exobot

Exobot has been distributed using direct download links.[15]
S0509 FakeSpy

FakeSpy has been distributed via direct download links in SMS phishing messages.[16]
S0421 GolfSpy

GolfSpy has the ability to install adversary-specified applications.[10]
S0406 Gustuff

Gustuff has been distributed via SMS phishing messages to phone numbers exfiltrated from compromised devices’ contact lists.[17]
S0544 HenBox

HenBox has been distributed via third-party application stores.[18]
S9048 KoSpy

KoSpy has been distributed via the third-party application store Apkpure.[19]

S0317 Marcher

Marcher has been delivered via a link sent by SMS or email, including instructions advising the user to modify their Android device security settings to enable applications to be installed from "Unknown Sources."[20]
S0303 MazarBOT

MazarBOT has been delivered via an unsolicited text message containing a link to a web download URI.[21]
S9040 NGate

NGate has been distributed via files[.]fm and through fake websites that mimic legitimate services, such as banking websites and Rio de Prêmios, a lottery website.[22][23][24]

S0399 Pallas

Pallas has the ability to download and install attacker-specified applications.[13]
S0539 Red Alert 2.0

Red Alert 2.0 has been distributed via webpages designed to look like the Play Store.[25]
S0326 RedDrop

RedDrop has used advertisements or other links within websites to encourage users to download the malicious applications using a complex content distribution network (CDN) and series of network redirects. RedDrop also downloads additional components (APKs, JAR files) from different C2 servers.[26]
S0403 Riltok

Riltok has been distributed via phishing SMS messages from infected devices.[27]
S0411 Rotexy

Rotexy has been distributed through phishing links sent in SMS messages as AvitoPay.apk.[28]
S0313 RuMMS

RuMMS has been delivered via an SMS message containing a link to an APK (Android application package).[29]
S0419 SimBad

SimBad has the ability to install adversary-specified applications.[30]
S0491 StrongPity

StrongPity has been distributed via a domain containing the word "dutch" and via a website impersonating the legitimate website shagle[.]com.[31]
S0558 Tiktok Pro

Tiktok Pro has been distributed via direct download on third party websites, with the link sent in phishing SMS messages.[32]
S0302 Twitoor

Twitoor has the ability to install adversary-specified applications.[33]
S0418 ViceLeaker

ViceLeaker has been primarily distributed via Telegram and WhatsApp messages.[34]
S0506 ViperRAT

ViperRAT has been distributed through third party websites.[35]
G0112 Windshift

Windshift has distributed malicious applications via their own websites during Operation BULL.[36]
S0318 XLoader for Android

XLoader for Android has been distributed via phishing websites.[37]
S0490 XLoader for iOS

XLoader for iOS has been distributed via phishing SMS messages, which link to a malicious website hosting a device profile.[37]
S0311 YiSpecter

YiSpecter has been signed with iOS enterprise certificates issued by Apple to allow the malicious applications to be installed as enterprise applications on non-jailbroken iOS devices.[38]
S0287 ZergHelper

ZergHelper has abused enterprise and personal certificates to sign and distribute applications.[39]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection Strategy

ID Name Analytic ID Analytic Description
DET0940 Detection of Mobile Application Delivery Outside Authorized Distribution Channels AN2290

On managed Android devices with the necessary network and security telemetry enabled, identify an application package retrieved through a browser, messaging application, third-party store, or another external delivery mechanism. Correlate the package retrieval with a subsequent installation event on the same device, using package identity, delivery source, timing, and installer provenance where available.

Prioritize cases where the delivery source is outside approved distribution channels, the installer is inconsistent with authorized workflows, and the application is not approved for the device or user. Exclude sanctioned enterprise deployments, approved testing, and documented alternative distribution channels.
AN2291

On managed iOS devices, identify observable delivery of an application package or distribution link through an external website, messaging channel, or other non-approved distribution mechanism.

Where managed network inspection exposes the transaction, identify application-package retrieval or a distribution workflow outside the organization's approved channels. Correlate this with an application newly appearing in device inventory or with a managed-app lifecycle change, using bundle identifier, distribution attributes, and timing where available.

Prioritize cases where the distribution evidence is independently observed and inconsistent with authorized enterprise distribution, alternative marketplaces, or approved testing workflows.

References

  1. A Prasad. (2016, February 19). Danger lurks in third-party Android app stores. Retrieved November 8, 2018.
  2. Jordan Pan. (2016, February 10). User Beware: Rooting Malware Found in 3rd Party App Stores. Retrieved November 8, 2018.
  3. Veo Zhang. (2014, February 18). Flappy Bird and Third-Party App Stores. Retrieved November 8, 2018.
  4. Lukáš Štefanko. (2018, December 11). Android Trojan steals money from PayPal accounts even with 2FA on. Retrieved July 11, 2019.
  5. A. Hazum, F. He, I. Marom, B. Melnykov, A. Polkovnichenko. (2019, July 10). Agent Smith: A New Species of Mobile Malware. Retrieved May 7, 2020.
  6. Costin Raiu, Denis Maslennikov, Kurt Baumgartner. (2013, March 26). Android Trojan Found in Targeted Attack. Retrieved December 23, 2016.
  7. D. Venkatesan. (2020, October 8). Sophisticated new Android malware marks the latest evolution of mobile ransomware . Retrieved October 29, 2020.
  8. M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved April 8, 2020.
  9. T. Shishkova. (2018, August 28). The rise of mobile banker Asacub. Retrieved December 14, 2020.
  10. E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.
  11. Hazum, A., Melnykov, B., Wernik, I.. (2020, July 9). New Joker variant hits Google Play with an old trick. Retrieved July 20, 2020.
  12. Z. Doffman. (2019, August 16). Warning As Devious New Android Malware Hides In Fake Adobe Flash Player Installations (Updated). Retrieved June 26, 2020.
  13. Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
  14. A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.
  15. Threat Fabric. (2017, February). Exobot - Android banking Trojan on the rise. Retrieved October 29, 2020.
  16. O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020.
  17. Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019.
  18. A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.
  19. Islamoglu, A. (2025, March 12). Lookout Discovers New Spyware by North Korean APT37. Retrieved December 1, 2025.
  20. Proofpoint. (2017, November 3). Credential phishing and an Android banking Trojan combine in Austrian mobile attacks. Retrieved July 6, 2018.
  1. Graham Cluley. (2016, February 16). Android users warned of malware attack spreading via SMS. Retrieved December 23, 2016.
  2. Stefanko, L., Osmani, J. (2024, August 22). NGate Android malware relays NFC traffic to steal cash. Retrieved November 10, 2025.
  3. Ratajczak, K. (2025, November 3). Analysis of NGate malware campaign (NFC relay). Retrieved November 10, 2025.
  4. Stefanko, L. (2026, April 21). New NGate variant hides in a trojanized NFC payment app. Retrieved May 6, 2026.
  5. J. Chandraiah. (2018, July 23). Red Alert 2.0: Android Trojan targets security-seekers. Retrieved December 14, 2020.
  6. Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved September 18, 2018.
  7. Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019.
  8. T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
  9. Wu Zhou, Deyu Hu, Jimmy Su, Yong Kang. (2016, April 26). RUMMS: THE LATEST FAMILY OF ANDROID MALWARE ATTACKING USERS IN RUSSIA VIA SMS PHISHING. Retrieved February 6, 2017.
  10. Elena Root, Andrey Polkovnichenko. (2019, March 13). SimBad: A Rogue Adware Campaign On Google Play. Retrieved November 21, 2019.
  11. Stefanko, L. (2023, January 10). StrongPity espionage campaign targeting Android users. Retrieved January 31, 2023.
  12. S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.
  13. ESET. (2016, August 24). First Twitter-controlled Android botnet discovered. Retrieved December 22, 2016.
  14. GReAT. (2019, June 26). ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.
  15. M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020.
  16. The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.
  17. Hiroaki, H., Wu, L., Wu, L.. (2019, April 2). XLoader Disguises as Android Apps, Has FakeSpy Links. Retrieved July 20, 2020.
  18. Claud Xiao. (2015, October 4). YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs. Retrieved January 20, 2017.
  19. Claud Xiao. (2016, February 21). Pirated iOS App Store’s Client Successfully Evaded Apple iOS Code Review. Retrieved December 12, 2016.