Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1437.001: Web Protocols

Adversaries may communicate using application layer protocols associated with web protocols traffic to avoid detection/network filtering by blending in with existing traffic. Commands to remote mobile devices, and often the results of those commands, will be embedded within the protocol traffic between the mobile client and server.

Web protocols such as HTTP and HTTPS are used for web traffic as well as well as notification services native to mobile messaging services such as Google Cloud Messaging (GCM) and newly, Firebase Cloud Messaging (FCM), (GCM/FCM: two-way communication) and Apple Push Notification Service (APNS; one-way server-to-device). Such notification services leverage HTTP/S via the respective API and are commonly abused on Android and iOS respectively in order blend in with routine device traffic making it difficult for enterprises to inspect.

MobileT1437.001Sub-techniqueObject v1.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Web Protocols for mobile ATT&CK describes adversary command-and-control or data exchange hidden inside normal-looking HTTP/HTTPS and mobile notification traffic. For leaders, the issue is not that web traffic exists; it is that Android and iOS devices routinely use encrypted web and push-notification services that enterprises may have limited ability to inspect, making mobile compromise harder to separate from legitimate business traffic.

Executive priority

Prioritize this where mobile devices handle sensitive communications, financial workflows, identity approval, or regulated data. The decision question is whether the organization can explain and evidence how it monitors managed mobile devices, risky apps, and unusual network destinations without relying on full content inspection. This technique is also relevant to IR readiness: if a mobile incident occurs, teams need mobile network, app, and device-management evidence available quickly enough to determine whether command traffic used common web or notification channels.

Technical view

This is a mobile sub-technique of Application Layer Protocol affecting Android and iOS. ATT&CK does not provide a detection description, but the relationship to DET0620 indicates a detection strategy exists. SOC and detection teams should validate visibility for mobile HTTP/HTTPS patterns, connections to unfamiliar client/server infrastructure, and abuse patterns around Google Cloud Messaging/Firebase Cloud Messaging on Android and Apple Push Notification Service on iOS. Because the related ATT&CK relationships include multiple Android malware families, iOS spyware, and a documented campaign/group using this behavior, detections should be tested against mobile-specific C2 assumptions rather than only desktop web-proxy logic.

Likely telemetry

  • Mobile device management or enterprise mobility management device and app inventory
  • Mobile threat defense or mobile endpoint security alerts, where deployed
  • Network, secure web gateway, proxy, firewall, or VPN metadata for mobile device traffic
  • DNS resolution logs associated with managed mobile devices
  • TLS/HTTPS metadata such as destination, certificate, SNI, timing, and volume where lawfully and technically available

Detection direction

  • Confirm whether managed Android and iOS traffic is attributable to a user, device, and installed app; lack of attribution is a major blind spot for this behavior.
  • Baseline expected mobile web and notification-service destinations, then investigate unusual domains, rare endpoints, abnormal beaconing cadence, or unexpected data volume from mobile apps.
  • Tune carefully: HTTP/HTTPS, FCM, GCM, and APNS are common legitimate services, so detection should rely on context, app reputation, device posture, destination rarity, and behavioral anomalies rather than protocol presence alone.
  • Correlate mobile network events with app inventory and recent app installs, especially for sideloaded, unmanaged, or policy-noncompliant apps.
  • Ensure incident responders can preserve relevant MDM/EMM, network, DNS, and mobile security logs before short retention windows expire.

Mitigation priorities

  • Establish mobile device enrollment, app inventory, and compliance baselines for devices accessing sensitive services.
  • Restrict unmanaged or high-risk apps where business policy allows, and review sideloading exposure on Android and enterprise/developer profile exposure on iOS.
  • Route managed mobile traffic through approved security controls where feasible, while recognizing encrypted web and notification traffic may limit content inspection.
  • Use risk-based conditional access so mobile device posture affects access to business applications and identity workflows.
  • Maintain IR playbooks for mobile compromise that include collection of device-management records, app lists, network metadata, and DNS/proxy evidence.
Analyst notes and limits

ATT&CK links this technique to many mobile software entries, including Android malware, iOS spyware, and banking or spyware families, plus campaign/group context. That relationship breadth makes the behavior strategically important for mobile defense, but it does not by itself prove current activity in any environment. The strongest local validation will come from whether mobile traffic can be tied back to a device and app.

The official ATT&CK object has no tactic and no official detection text. Recommendations are therefore framed as validation directions based on the supplied description, platforms, external references, and relationships, not as guaranteed detections or vendor-specific controls.

Official MITRE ATT&CK definition

Web Protocols

Adversaries may communicate using application layer protocols associated with web protocols traffic to avoid detection/network filtering by blending in with existing traffic. Commands to remote mobile devices, and often the results of those commands, will be embedded within the protocol traffic between the mobile client and server.

Web protocols such as HTTP and HTTPS are used for web traffic as well as well as notification services native to mobile messaging services such as Google Cloud Messaging (GCM) and newly, Firebase Cloud Messaging (FCM), (GCM/FCM: two-way communication) and Apple Push Notification Service (APNS; one-way server-to-device). Such notification services leverage HTTP/S via the respective API and are commonly abused on Android and iOS respectively in order blend in with routine device traffic making it difficult for enterprises to inspect.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Mobile T1437 Application Layer Protocol This object subtechnique of Application Layer Protocol.
Associated objects

Groups, software, and campaigns

Malware Mobile

S1093: FlyTrap

FlyTrap is an Android trojan, first detected in March 2021, that uses social engineering tactics to compromise Facebook accounts. FlyTrap was initially detected through infected apps on the Google Play store, and is believed to have impacted over 10,000 victims across at least 140 countries.[1]

Android
Malware Mobile

S1185: LightSpy

First observed in 2018, LightSpy is a modular malware family that initially targeted iOS devices in Southern Asia before expanding to Android and macOS platforms. It consists of a downloader, a main executable that manages network communications, and functionality-specific modules, typically implemented as `.dylib` files (iOS, macOS) or `.apk` files (Android). LightSpy can collect VoIP call recordings, SMS messages, and credential stores, which are then exfiltrated to a command and control (C2) server.[1]

AndroidWindowsiOS
Malware Mobile

S0478: EventBot

EventBot is an Android banking trojan and information stealer that abuses Android’s accessibility service to steal data from various applications.[1] EventBot was designed to target over 200 different banking and financial applications, the majority of which are European bank and cryptocurrency exchange applications.[1]

Android
Malware Mobile

S1241: RatMilad

RatMilad is an Android remote access tool (RAT) with spyware functionality that has been used to target enterprise mobile devices in the Middle East since at least 2021. Variants of RatMilad have been disguised as VPN applications and a fake app named NumRent. Upon installation, RatMilad employs multiple Collection techniques to collect sensitive information before uploading the collected data to its command and control (C2) server. [1]

Android
Malware Mobile

S1095: AhRat

AhRat is an Android remote access tool based on the open-source AhMyth remote access tool. AhRat initially spread in August 2022 on the Google Play Store via an update containing malicious code to the previously benign application, “iRecorder – Screen Recorder,” which itself was released in September 2021.[1]

Android
Malware Mobile

S0427: TrickMo

TrickMo a 2FA bypass mobile banking trojan, most likely being distributed by TrickBot. TrickMo has been primarily targeting users located in Germany.[1]

TrickMo is designed to steal transaction authorization numbers (TANs), which are typically used as one-time passwords.[1]

Android
Malware Mobile

S1083: Chameleon

Chameleon is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, Chameleon has been observed targeting users in Australia and Poland by masquerading as official applications. A new variant of Chameleon has expanded its targets to include Android users in the United Kingdom and Italy.[1][2]

Android
Relationship explorer

All related ATT&CK context

uses · Malware S0536: GPlayed Mobile uses · Campaign C0033: C0033 Mobile uses · Malware S1093: FlyTrap Mobile uses · Malware S1185: LightSpy Mobile uses · Malware S0478: EventBot Mobile uses · Malware S1241: RatMilad Mobile uses · Malware S1095: AhRat Mobile uses · Malware S0555: CHEMISTGAMES Mobile uses · Malware S0427: TrickMo Mobile uses · Malware S0308: Trojan-SMS.AndroidOS.OpFake.a Mobile uses · Malware S0307: Trojan-SMS.AndroidOS.Agent.ao Mobile uses · Malware S0403: Riltok Mobile subtechnique of · Technique T1437: Application Layer Protocol Mobile uses · Malware S1083: Chameleon Mobile uses · Malware S0326: RedDrop Mobile uses · Malware S1231: GodFather Mobile uses · Malware S0535: Golden Cup Mobile uses · Malware S0549: SilkBean Mobile uses · Malware S0304: Android/Chuli.A Mobile uses · Malware S1077: Hornbill Mobile uses · Malware S0405: Exodus Mobile uses · Malware S0313: RuMMS Mobile uses · Malware S0306: Trojan-SMS.AndroidOS.FakeInst.a Mobile uses · Malware S0525: Android/AdDisplay.Ashas Mobile
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
97a6e462ff7b77ea...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.0 Current bundle 97a6e462ff7b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    NIST Mobile Threat Catalogue APP-29
    Open source URL
  2. [2]
    mitre-attack T1437.001
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use