aol.pm

Deliver Malicious Application via Other Means

Technique · ATTACK:mobile:T1476

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1476",
  "title": "Deliver Malicious Application via Other Means",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1476",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--53263a67-075e-48fa-974b-91c5b5445db7",
  "external_id": "T1476",
  "domain": "mobile",
  "created": "2018-10-17T00:14:20.652Z",
  "modified": "2026-09-03T14:38:12.546Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "initial-access"
  ],
  "source_references": [
    {
      "source_name": "IBTimes-ThirdParty",
      "url": "https://www.ibtimes.co.uk/danger-lurks-third-party-android-app-stores-1544861"
    },
    {
      "source_name": "TrendMicro-RootingMalware",
      "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/user-beware-rooting-malware-found-in-3rd-party-app-stores/"
    },
    {
      "source_name": "android-trojan-steals-paypal-2fa",
      "url": "https://www.welivesecurity.com/2018/12/11/android-trojan-steals-money-paypal-accounts-2fa/"
    },
    {
      "source_name": "TrendMicro-FlappyBird",
      "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/flappy-bird-and-third-party-app-stores/"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-9.html",
      "external_id": "AUT-9"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/ecosystem-threats/ECO-13.html",
      "external_id": "ECO-13"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/ecosystem-threats/ECO-21.html",
      "external_id": "ECO-21"
    }
  ]
}

Explicit source assertions (34)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0419 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03683255-a5fa-44ef-83b8-0bd55386c4b9

CheckPoint SimBad 2019

ATTACK:mobile:S0403 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c53692d-16a1-4c25-8a3e-30802b2d0c7f

Kaspersky Riltok June 2019

ATTACK:mobile:G0097 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10c503d7-850b-4ae2-8b14-186cbe214d33

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S0432 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--283f4e8e-07dc-4d22-84f9-536f9024307a

Check Point-Joker

ATTACK:mobile:S0287 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a287c91-2792-407f-a9ee-8153a802b7c6

Xiao-ZergHelper

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a94bb7e-67af-4031-b4be-25c2a3ccd35c

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32625429-e05a-48a5-8f0b-53c6046e9b1a

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--336f139f-b771-48d4-a3d6-7ef94289d56e

Lookout ViperRAT

ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4343ef82-8329-43e3-a6a2-116238fe2fcd

CERTPL_NGate_Nov2025 · ESETStefanko_NGateVariant_Apr2026 · ESETStefankoOsmani_NGate_Aug2024

ATTACK:mobile:S0303 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fc45b06-287d-4151-9f5a-37bb34dcdeec

Tripwire-MazarBOT

ATTACK:mobile:S0524 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55ce7832-8322-4cb3-b300-1abae68ce2ac

Microsoft MalLockerB

ATTACK:mobile:S0302 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ee89b0e-a2ab-40c8-88fd-54f974ea00b1

ESET-Twitoor

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71b8f72c-72da-4547-9729-0f60b11917c4

Zscaler TikTok Spyware

ATTACK:mobile:S0539 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ba3b225-5446-4e9d-886b-1eb5c503e77a

Sophos Red Alert 2.0

ATTACK:mobile:S0507 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e189d23-1317-4c1d-a8b1-c5877eeb7a02

Lookout eSurv

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--979e6503-41a2-43f5-a30f-045272faa7d0

Cybereason FakeSpy

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--986cb3bf-98bb-4558-bec4-bd8c015449fd

SecureList - ViceLeaker 2019

ATTACK:mobile:S0318 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d087e80-c58e-45ed-bc5d-bc99e3e3e42e

TrendMicro-XLoader-FakeSpy

ATTACK:mobile:S0311 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ea81224-70ef-46c2-89d4-2261c11789b4

PaloAlto-YiSpecter

ATTACK:mobile:S0326 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3ba222d-8dcd-4222-b1d0-169eff16922f

Wandera-RedDrop

ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6876100-1ed4-4c26-8de7-dc5ee09a8feb

Threat Fabric Exobot

ATTACK:mobile:S0490 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7c74081-2844-4f0a-9fcc-c30a98717798

TrendMicro-XLoader-FakeSpy

ATTACK:mobile:G0070 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae9a0fb3-901b-4da2-b6ad-633ddbfa0a5f

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0313 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbf13431-c3d2-4800-aada-273b3a47dcba

FireEye-RuMMS

ATTACK:mobile:S0540 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be92314d-bf3f-4a02-852b-3d1ab85e8d7d

Securelist Asacub

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c200184f-3d11-452c-8362-bb66337df1f5

Cofense Anubis

ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbde808a-08b3-4afc-bb87-21acc4b767c1

securelist rotexy 2018

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf09dc99-25fc-4434-82b0-ee6696e87f91

Palo Alto HenBox

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfda3abb-4372-4dbf-ace3-b8d5a0a6ad60

Talos Gustuff Apr 2019

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8ee0bd2-3f05-4fc0-854b-63ee92a293ca

BlackBerry Bahamut

ATTACK:mobile:S0440 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e723fde7-7fa9-4ac8-a8ec-3fcbf097dbc8

CheckPoint Agent Smith

ATTACK:mobile:S0304 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0a81b31-97ce-403b-90e9-7a910a93a31f

Kaspersky-WUC

ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f101c454-affd-432b-b08b-a8dd7513684a

Forbes Cerberus

ATTACK:mobile:S0491 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5f001b0-5a2c-442f-a33e-296424be82c3

welivesec_strongpity

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.