{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1476","id":"T1476","name":"Deliver Malicious Application via Other Means","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1476","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"f0ffa7366837e205968ab0014da804fa0f0763996cba5aa4ed1bb2f8127ba4b2","description":"Adversaries may direct victims to download malicious applications via ways that avoid an authorized application store (e.g. Google Play Store or Apple App Store). For example, victims may be directed to downloading  a malicious APK directly from a domain. Adversaries may wish to avoid placing malicious applications in an authorized application store due to increased potential risk of detection or other reasons.\n\nDelivery methods for malicious applications include:\n\n* Spearphishing Attachment: including the mobile application package as an attachment to an email\n* Spearphishing Link: including a link to the mobile application package within an email, text message (e.g. SMS, iMessage, WhatsApp, etc.), web site, QR code, or other means.\n* Third-Party Application Store: installing the mobile application package from a third-party application store, as opposed to an authorized app store that the device implicitly trusts as part of its default behavior. Third-party application stores may not apply the same level of scrutiny to applications as enforced by an authorized application store.(Citation: IBTimes-ThirdParty)(Citation: TrendMicro-RootingMalware)(Citation: TrendMicro-FlappyBird) \n\nSome Android malware comes with functionality to install additional applications, either automatically or when the adversary instructs it to.(Citation: android-trojan-steals-paypal-2fa)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1476","external_id":"T1476"},{"source_name":"IBTimes-ThirdParty","description":"A Prasad. (2016, February 19). Danger lurks in third-party Android app stores. Retrieved November 8, 2018.","url":"https://www.ibtimes.co.uk/danger-lurks-third-party-android-app-stores-1544861"},{"source_name":"TrendMicro-RootingMalware","description":"Jordan Pan. (2016, February 10). User Beware: Rooting Malware Found in 3rd Party App Stores. Retrieved November 8, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/user-beware-rooting-malware-found-in-3rd-party-app-stores/"},{"source_name":"android-trojan-steals-paypal-2fa","description":"Lukáš Štefanko. (2018, December 11). Android Trojan steals money from PayPal accounts even with 2FA on. Retrieved July 11, 2019.","url":"https://www.welivesecurity.com/2018/12/11/android-trojan-steals-money-paypal-accounts-2fa/"},{"source_name":"TrendMicro-FlappyBird","description":"Veo Zhang. (2014, February 18). Flappy Bird and Third-Party App Stores. Retrieved November 8, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/flappy-bird-and-third-party-app-stores/"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-9.html","external_id":"AUT-9"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/ecosystem-threats/ECO-13.html","external_id":"ECO-13"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/ecosystem-threats/ECO-21.html","external_id":"ECO-21"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"source_mapping_gap","visibility_note":null,"parent":null,"children":[],"telemetry":[],"detection":{"key":"mobile/T1476","id":"T1476","name":"Deliver Malicious Application via Other Means","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1476","technique_page":"techniques/mobile/T1476/","page":"detections/mobile/T1476/","status":"evidence_gap","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":0,"analytics":0,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[],"telemetry_references":[],"visibility":"source_mapping_gap","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0287","name":"ZergHelper","url":"https://attack.mitre.org/software/S0287","kind":"malware","description":"[ZergHelper](https://attack.mitre.org/software/S0287) has abused enterprise and personal certificates to sign and distribute applications.(Citation: Xiao-ZergHelper)","relationship_id":"relationship--2a287c91-2792-407f-a9ee-8153a802b7c6","references":[{"source_name":"Xiao-ZergHelper","description":"Claud Xiao. (2016, February 21). Pirated iOS App Store’s Client Successfully Evaded Apple iOS Code Review. Retrieved December 12, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/02/pirated-ios-app-stores-client-successfully-evaded-apple-ios-code-review/"}]},{"id":"S0302","name":"Twitoor","url":"https://attack.mitre.org/software/S0302","kind":"malware","description":"[Twitoor](https://attack.mitre.org/software/S0302) has the ability to install adversary-specified applications.(Citation: ESET-Twitoor)","relationship_id":"relationship--6ee89b0e-a2ab-40c8-88fd-54f974ea00b1","references":[{"source_name":"ESET-Twitoor","description":"ESET. (2016, August 24). First Twitter-controlled Android botnet discovered. Retrieved December 22, 2016.","url":"http://www.welivesecurity.com/2016/08/24/first-twitter-controlled-android-botnet-discovered/"}]},{"id":"S0303","name":"MazarBOT","url":"https://attack.mitre.org/software/S0303","kind":"malware","description":"[MazarBOT](https://attack.mitre.org/software/S0303) has been delivered via an unsolicited text message containing a link to a web download URI.(Citation: Tripwire-MazarBOT)","relationship_id":"relationship--4fc45b06-287d-4151-9f5a-37bb34dcdeec","references":[{"source_name":"Tripwire-MazarBOT","description":"Graham Cluley. (2016, February 16). Android users warned of malware attack spreading via SMS. Retrieved December 23, 2016.","url":"https://www.tripwire.com/state-of-security/security-data-protection/android-malware-sms/"}]},{"id":"S0304","name":"Android/Chuli.A","url":"https://attack.mitre.org/software/S0304","kind":"malware","description":"[Android/Chuli.A](https://attack.mitre.org/software/S0304) has been delivered via a spearphishing message containing a malicious Android application as an attachment.(Citation: Kaspersky-WUC)","relationship_id":"relationship--f0a81b31-97ce-403b-90e9-7a910a93a31f","references":[{"source_name":"Kaspersky-WUC","description":"Costin Raiu, Denis Maslennikov, Kurt Baumgartner. (2013, March 26). Android Trojan Found in Targeted Attack. Retrieved December 23, 2016.","url":"https://securelist.com/android-trojan-found-in-targeted-attack-58/35552/"}]},{"id":"S0311","name":"YiSpecter","url":"https://attack.mitre.org/software/S0311","kind":"malware","description":"[YiSpecter](https://attack.mitre.org/software/S0311) has been signed with iOS enterprise certificates issued by Apple to allow the malicious applications to be installed as enterprise applications on non-jailbroken iOS devices.(Citation: PaloAlto-YiSpecter)","relationship_id":"relationship--9ea81224-70ef-46c2-89d4-2261c11789b4","references":[{"source_name":"PaloAlto-YiSpecter","description":"Claud Xiao. (2015, October 4). YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs. Retrieved January 20, 2017.","url":"https://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/"}]},{"id":"S0313","name":"RuMMS","url":"https://attack.mitre.org/software/S0313","kind":"malware","description":"[RuMMS](https://attack.mitre.org/software/S0313) has been delivered via an SMS message containing a link to an APK (Android application package).(Citation: FireEye-RuMMS)","relationship_id":"relationship--bbf13431-c3d2-4800-aada-273b3a47dcba","references":[{"source_name":"FireEye-RuMMS","description":"Wu Zhou, Deyu Hu, Jimmy Su, Yong Kang. (2016, April 26). RUMMS: THE LATEST FAMILY OF ANDROID MALWARE ATTACKING USERS IN RUSSIA VIA SMS PHISHING. Retrieved February 6, 2017.","url":"https://www.fireeye.com/blog/threat-research/2016/04/rumms-android-malware.html"}]},{"id":"S0318","name":"XLoader for Android","url":"https://attack.mitre.org/software/S0318","kind":"malware","description":"[XLoader for Android](https://attack.mitre.org/software/S0318) has been distributed via phishing websites.(Citation: TrendMicro-XLoader-FakeSpy)","relationship_id":"relationship--9d087e80-c58e-45ed-bc5d-bc99e3e3e42e","references":[{"source_name":"TrendMicro-XLoader-FakeSpy","description":"Hiroaki, H., Wu, L., Wu, L.. (2019, April 2). XLoader Disguises as Android Apps, Has FakeSpy Links. Retrieved July 20, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-version-of-xloader-that-disguises-as-android-apps-and-an-ios-profile-holds-new-links-to-fakespy/"}]},{"id":"S0326","name":"RedDrop","url":"https://attack.mitre.org/software/S0326","kind":"malware","description":"[RedDrop](https://attack.mitre.org/software/S0326) has used advertisements or other links within websites to encourage users to download the malicious applications using a complex content distribution network (CDN) and series of network redirects. [RedDrop](https://attack.mitre.org/software/S0326) also downloads additional components (APKs, JAR files) from different C2 servers.(Citation: Wandera-RedDrop)","relationship_id":"relationship--a3ba222d-8dcd-4222-b1d0-169eff16922f","references":[{"source_name":"Wandera-RedDrop","description":"Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved September 18, 2018.","url":"https://www.wandera.com/reddrop-malware/"}]},{"id":"S0399","name":"Pallas","url":"https://attack.mitre.org/software/S0399","kind":"malware","description":"[Pallas](https://attack.mitre.org/software/S0399) has the ability to download and install attacker-specified applications.(Citation: Lookout Dark Caracal Jan 2018)","relationship_id":"relationship--32625429-e05a-48a5-8f0b-53c6046e9b1a","references":[{"source_name":"Lookout Dark Caracal Jan 2018","description":"Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"id":"S0403","name":"Riltok","url":"https://attack.mitre.org/software/S0403","kind":"malware","description":"[Riltok](https://attack.mitre.org/software/S0403) has been distributed via phishing SMS messages from infected devices.(Citation: Kaspersky Riltok June 2019)","relationship_id":"relationship--0c53692d-16a1-4c25-8a3e-30802b2d0c7f","references":[{"source_name":"Kaspersky Riltok June 2019","description":"Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019.","url":"https://securelist.com/mobile-banker-riltok/91374/"}]},{"id":"S0406","name":"Gustuff","url":"https://attack.mitre.org/software/S0406","kind":"malware","description":"[Gustuff](https://attack.mitre.org/software/S0406) has been distributed via SMS phishing messages to phone numbers exfiltrated from compromised devices’ contact lists.(Citation: Talos Gustuff Apr 2019)","relationship_id":"relationship--cfda3abb-4372-4dbf-ace3-b8d5a0a6ad60","references":[{"source_name":"Talos Gustuff Apr 2019","description":"Vitor Ventura. (2019, April 9).  Gustuff banking botnet targets Australia . Retrieved September 3, 2019.","url":"https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html"}]},{"id":"S0411","name":"Rotexy","url":"https://attack.mitre.org/software/S0411","kind":"malware","description":"[Rotexy](https://attack.mitre.org/software/S0411) has been distributed through phishing links sent in SMS messages as `AvitoPay.apk`.(Citation: securelist rotexy 2018)","relationship_id":"relationship--cbde808a-08b3-4afc-bb87-21acc4b767c1","references":[{"source_name":"securelist rotexy 2018","description":"T. Shishkova, L. Pikman. (2018, November 22).  The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.","url":"https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/"}]},{"id":"S0418","name":"ViceLeaker","url":"https://attack.mitre.org/software/S0418","kind":"malware","description":"[ViceLeaker](https://attack.mitre.org/software/S0418) has been primarily distributed via Telegram and WhatsApp messages.(Citation: SecureList - ViceLeaker 2019)","relationship_id":"relationship--986cb3bf-98bb-4558-bec4-bd8c015449fd","references":[{"source_name":"SecureList - ViceLeaker 2019","description":"GReAT. (2019, June 26).  ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.","url":"https://securelist.com/fanning-the-flames-viceleaker-operation/90877/"}]},{"id":"S0419","name":"SimBad","url":"https://attack.mitre.org/software/S0419","kind":"malware","description":"[SimBad](https://attack.mitre.org/software/S0419) has the ability to install adversary-specified applications.(Citation: CheckPoint SimBad 2019)","relationship_id":"relationship--03683255-a5fa-44ef-83b8-0bd55386c4b9","references":[{"source_name":"CheckPoint SimBad 2019","description":"Elena Root, Andrey Polkovnichenko. (2019, March 13). SimBad: A Rogue Adware Campaign On Google Play. Retrieved November 21, 2019.","url":"https://research.checkpoint.com/simbad-a-rogue-adware-campaign-on-google-play/"}]},{"id":"S0421","name":"GolfSpy","url":"https://attack.mitre.org/software/S0421","kind":"malware","description":"[GolfSpy](https://attack.mitre.org/software/S0421) has the ability to install adversary-specified applications.(Citation: Trend Micro Bouncing Golf 2019)","relationship_id":"relationship--2a94bb7e-67af-4031-b4be-25c2a3ccd35c","references":[{"source_name":"Trend Micro Bouncing Golf 2019","description":"E. Xu, G. Guo. (2019, June 28).  Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/"}]},{"id":"S0422","name":"Anubis","url":"https://attack.mitre.org/software/S0422","kind":"malware","description":"[Anubis](https://attack.mitre.org/software/S0422) has been distributed via a phishing link in an email.(Citation: Cofense Anubis)","relationship_id":"relationship--c200184f-3d11-452c-8362-bb66337df1f5","references":[{"source_name":"Cofense Anubis","description":"M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved April 8, 2020.","url":"https://cofense.com/infostealer-keylogger-ransomware-one-anubis-targets-250-android-applications/"}]},{"id":"S0432","name":"Bread","url":"https://attack.mitre.org/software/S0432","kind":"malware","description":"[Bread](https://attack.mitre.org/software/S0432) has the ability to install additional applications.(Citation: Check Point-Joker)","relationship_id":"relationship--283f4e8e-07dc-4d22-84f9-536f9024307a","references":[{"source_name":"Check Point-Joker","description":"Hazum, A., Melnykov, B., Wernik, I.. (2020, July 9). New Joker variant hits Google Play with an old trick. Retrieved July 20, 2020.","url":"https://research.checkpoint.com/2020/new-joker-variant-hits-google-play-with-an-old-trick/"}]},{"id":"S0440","name":"Agent Smith","url":"https://attack.mitre.org/software/S0440","kind":"malware","description":"[Agent Smith](https://attack.mitre.org/software/S0440) has been distributed through the 9apps application store.(Citation: CheckPoint Agent Smith) ","relationship_id":"relationship--e723fde7-7fa9-4ac8-a8ec-3fcbf097dbc8","references":[{"source_name":"CheckPoint Agent Smith","description":"A. Hazum, F. He, I. Marom, B. Melnykov, A. Polkovnichenko. (2019, July 10). Agent Smith: A New Species of Mobile Malware. Retrieved May 7, 2020.","url":"https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobile-malware/"}]},{"id":"S0480","name":"Cerberus","url":"https://attack.mitre.org/software/S0480","kind":"malware","description":"[Cerberus](https://attack.mitre.org/software/S0480) has been delivered to the victim device via websites that prompt the user to “[…] install Adobe Flash Player,” downloading the malicious APK to the device.(Citation: Forbes Cerberus)","relationship_id":"relationship--f101c454-affd-432b-b08b-a8dd7513684a","references":[{"source_name":"Forbes Cerberus","description":"Z. Doffman. (2019, August 16). Warning As Devious New Android Malware Hides In Fake Adobe Flash Player Installations (Updated). Retrieved June 26, 2020.","url":"https://www.forbes.com/sites/zakdoffman/2019/08/16/dangerous-new-android-trojan-hides-from-malware-researchers-and-taunts-them-on-twitter/#1563fef26d9c"}]},{"id":"S0490","name":"XLoader for iOS","url":"https://attack.mitre.org/software/S0490","kind":"malware","description":"[XLoader for iOS](https://attack.mitre.org/software/S0490) has been distributed via phishing SMS messages, which link to a malicious website hosting a device profile.(Citation: TrendMicro-XLoader-FakeSpy)","relationship_id":"relationship--a7c74081-2844-4f0a-9fcc-c30a98717798","references":[{"source_name":"TrendMicro-XLoader-FakeSpy","description":"Hiroaki, H., Wu, L., Wu, L.. (2019, April 2). XLoader Disguises as Android Apps, Has FakeSpy Links. Retrieved July 20, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-version-of-xloader-that-disguises-as-android-apps-and-an-ios-profile-holds-new-links-to-fakespy/"}]},{"id":"S0491","name":"StrongPity","url":"https://attack.mitre.org/software/S0491","kind":"malware","description":"[StrongPity](https://attack.mitre.org/software/S0491) has been distributed via a domain containing the word “dutch” and via a website impersonating the legitimate website shagle[.]com.(Citation: welivesec_strongpity)","relationship_id":"relationship--f5f001b0-5a2c-442f-a33e-296424be82c3","references":[{"source_name":"welivesec_strongpity","description":"Stefanko, L. (2023, January 10). StrongPity espionage campaign targeting Android users. Retrieved January 31, 2023.","url":"https://www.welivesecurity.com/2023/01/10/strongpity-espionage-campaign-targeting-android-users/"}]},{"id":"S0506","name":"ViperRAT","url":"https://attack.mitre.org/software/S0506","kind":"malware","description":"[ViperRAT](https://attack.mitre.org/software/S0506) has been distributed through third party websites.(Citation: Lookout ViperRAT)","relationship_id":"relationship--336f139f-b771-48d4-a3d6-7ef94289d56e","references":[{"source_name":"Lookout ViperRAT","description":"M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020.","url":"https://blog.lookout.com/viperrat-mobile-apt"}]},{"id":"S0507","name":"eSurv","url":"https://attack.mitre.org/software/S0507","kind":"malware","description":"[eSurv](https://attack.mitre.org/software/S0507) has been distributed via phishing websites with geo-restrictions that allow access to only Italian and Turkmenistani mobile carriers. [eSurv](https://attack.mitre.org/software/S0507) also has the ability to install applications via malicious iOS provisioning profiles containing the developer’s certificate.(Citation: Lookout eSurv)","relationship_id":"relationship--7e189d23-1317-4c1d-a8b1-c5877eeb7a02","references":[{"source_name":"Lookout eSurv","description":"A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.","url":"https://blog.lookout.com/esurv-research"}]},{"id":"S0509","name":"FakeSpy","url":"https://attack.mitre.org/software/S0509","kind":"malware","description":"[FakeSpy](https://attack.mitre.org/software/S0509) has been distributed via direct download links in SMS phishing messages.(Citation: Cybereason FakeSpy)","relationship_id":"relationship--979e6503-41a2-43f5-a30f-045272faa7d0","references":[{"source_name":"Cybereason FakeSpy","description":"O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020.","url":"https://www.cybereason.com/blog/fakespy-masquerades-as-postal-service-apps-around-the-world"}]},{"id":"S0522","name":"Exobot","url":"https://attack.mitre.org/software/S0522","kind":"malware","description":"[Exobot](https://attack.mitre.org/software/S0522) has been distributed using direct download links.(Citation: Threat Fabric Exobot)","relationship_id":"relationship--a6876100-1ed4-4c26-8de7-dc5ee09a8feb","references":[{"source_name":"Threat Fabric Exobot","description":"Threat Fabric. (2017, February). Exobot - Android banking Trojan on the rise. Retrieved October 29, 2020.","url":"https://www.threatfabric.com/blogs/exobot_android_banking_trojan_on_the_rise.html"}]},{"id":"S0524","name":"AndroidOS/MalLocker.B","url":"https://attack.mitre.org/software/S0524","kind":"malware","description":"[AndroidOS/MalLocker.B](https://attack.mitre.org/software/S0524) has been distributed using direct download links.(Citation: Microsoft MalLockerB)","relationship_id":"relationship--55ce7832-8322-4cb3-b300-1abae68ce2ac","references":[{"source_name":"Microsoft MalLockerB","description":"D. Venkatesan. (2020, October 8). Sophisticated new Android malware marks the latest evolution of mobile ransomware . Retrieved October 29, 2020.","url":"https://www.microsoft.com/security/blog/2020/10/08/sophisticated-new-android-malware-marks-the-latest-evolution-of-mobile-ransomware/"}]},{"id":"S0539","name":"Red Alert 2.0","url":"https://attack.mitre.org/software/S0539","kind":"malware","description":"[Red Alert 2.0](https://attack.mitre.org/software/S0539) has been distributed via webpages designed to look like the Play Store.(Citation: Sophos Red Alert 2.0)","relationship_id":"relationship--7ba3b225-5446-4e9d-886b-1eb5c503e77a","references":[{"source_name":"Sophos Red Alert 2.0","description":"J. Chandraiah. (2018, July 23). Red Alert 2.0: Android Trojan targets security-seekers. Retrieved December 14, 2020.","url":"https://news.sophos.com/en-us/2018/07/23/red-alert-2-0-android-trojan-targets-security-seekers/"}]},{"id":"S0540","name":"Asacub","url":"https://attack.mitre.org/software/S0540","kind":"malware","description":"[Asacub](https://attack.mitre.org/software/S0540) has been delivered via phishing SMS messages that contain a link to a website that hosts the malicious APK file.(Citation: Securelist Asacub)","relationship_id":"relationship--be92314d-bf3f-4a02-852b-3d1ab85e8d7d","references":[{"source_name":"Securelist Asacub","description":"T. Shishkova. (2018, August 28).  The rise of mobile banker Asacub. Retrieved December 14, 2020.","url":"https://securelist.com/the-rise-of-mobile-banker-asacub/87591/"}]},{"id":"S0544","name":"HenBox","url":"https://attack.mitre.org/software/S0544","kind":"malware","description":"[HenBox](https://attack.mitre.org/software/S0544) has been distributed via third-party application stores.(Citation: Palo Alto HenBox)","relationship_id":"relationship--cf09dc99-25fc-4434-82b0-ee6696e87f91","references":[{"source_name":"Palo Alto HenBox","description":"A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.","url":"https://unit42.paloaltonetworks.com/unit42-henbox-chickens-come-home-roost/"}]},{"id":"S0558","name":"Tiktok Pro","url":"https://attack.mitre.org/software/S0558","kind":"malware","description":"[Tiktok Pro](https://attack.mitre.org/software/S0558) has been distributed via direct download on third party websites, with the link sent in phishing SMS messages.(Citation: Zscaler TikTok Spyware)","relationship_id":"relationship--71b8f72c-72da-4547-9729-0f60b11917c4","references":[{"source_name":"Zscaler TikTok Spyware","description":"S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.","url":"https://www.zscaler.com/blogs/security-research/tiktok-spyware"}]},{"id":"S9040","name":"NGate","url":"https://attack.mitre.org/software/S9040","kind":"malware","description":"[NGate](https://attack.mitre.org/software/S9040) has been distributed via files[.]fm and through fake websites that mimic legitimate services, such as banking websites and Rio de Prêmios, a lottery website.(Citation: ESETStefankoOsmani_NGate_Aug2024)(Citation: CERTPL_NGate_Nov2025)(Citation: ESETStefanko_NGateVariant_Apr2026) ","relationship_id":"relationship--4343ef82-8329-43e3-a6a2-116238fe2fcd","references":[{"source_name":"CERTPL_NGate_Nov2025","description":"Ratajczak, K. (2025, November 3). Analysis of NGate malware campaign (NFC relay). Retrieved November 10, 2025.","url":"https://cert.pl/en/posts/2025/11/analiza-ngate/"},{"source_name":"ESETStefanko_NGateVariant_Apr2026","description":"Stefanko, L. (2026, April 21). New NGate variant hides in a trojanized NFC payment app. Retrieved May 6, 2026.","url":"https://www.welivesecurity.com/en/eset-research/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app/"},{"source_name":"ESETStefankoOsmani_NGate_Aug2024","description":"Stefanko, L., Osmani, J. (2024, August 22). NGate Android malware relays NFC traffic to steal cash. Retrieved November 10, 2025.","url":"https://www.welivesecurity.com/en/eset-research/ngate-android-malware-relays-nfc-traffic-to-steal-cash/"}]}],"actors":[{"id":"G0070","name":"Dark Caracal","url":"https://attack.mitre.org/groups/G0070","kind":"intrusion-set","description":"[Dark Caracal](https://attack.mitre.org/groups/G0070) has distributed [Pallas](https://attack.mitre.org/software/S0399) via trojanized applications hosted on watering hole websites.(Citation: Lookout Dark Caracal Jan 2018) ","relationship_id":"relationship--ae9a0fb3-901b-4da2-b6ad-633ddbfa0a5f","references":[{"source_name":"Lookout Dark Caracal Jan 2018","description":"Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"id":"G0097","name":"Bouncing Golf","url":"https://attack.mitre.org/groups/G0097","kind":"intrusion-set","description":"[Bouncing Golf](https://attack.mitre.org/groups/G0097) has delivered [GolfSpy](https://attack.mitre.org/software/S0421) via a hosted application binary advertised on social media.(Citation: Trend Micro Bouncing Golf 2019) ","relationship_id":"relationship--10c503d7-850b-4ae2-8b14-186cbe214d33","references":[{"source_name":"Trend Micro Bouncing Golf 2019","description":"E. Xu, G. Guo. (2019, June 28).  Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/"}]},{"id":"G0112","name":"Windshift","url":"https://attack.mitre.org/groups/G0112","kind":"intrusion-set","description":"[Windshift](https://attack.mitre.org/groups/G0112) has distributed malicious applications via their own websites during Operation BULL.(Citation: BlackBerry Bahamut)","relationship_id":"relationship--d8ee0bd2-3f05-4fc0-854b-63ee92a293ca","references":[{"source_name":"BlackBerry Bahamut","description":"The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]}],"mitigations":[],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1476":"/ttp-simulation/techniques/mobile/T1476/"},"synthetic":null}