T1407: Download New Code at Runtime
Adversaries may download and execute dynamic code not included in the original application package after installation. This technique is primarily used to evade static analysis checks and pre-publication scans in official app stores. In some cases, more advanced dynamic or behavioral analysis techniques could detect this behavior. However, in conjunction with Execution Guardrails techniques, detecting malicious code downloaded after installation could be difficult.
On Android, dynamic code could include native code, Dalvik code, or JavaScript code that utilizes Android WebView’s `JavascriptInterface` capability.
On iOS, dynamic code could be downloaded and executed through 3rd party libraries such as JSPatch. [1]
Security context for executives and security teams
Download New Code at Runtime matters because a mobile app can appear acceptable during store review or static scanning, then fetch and run code after installation. For leaders, this turns mobile app trust into an ongoing runtime assurance problem: the risk is not only what was in the original Android or iOS package, but what the app can later retrieve and execute.
Executive priority
Prioritize this technique where mobile devices access sensitive business data, regulated workflows, executive communications, field operations, or critical infrastructure environments. Security leaders should ask whether mobile risk management depends mainly on app-store approval and pre-install scanning, or whether the organization can observe suspicious post-install code loading, enforce current OS versions, and produce audit evidence for mobile application control decisions.
Technical view
For SOC, detection engineering, and IR teams, validate Android and iOS visibility for applications that download executable or script-like content after installation. ATT&CK specifies Android dynamic code examples including native code, Dalvik code, and JavaScript using Android WebView JavascriptInterface; iOS examples include execution through third-party libraries such as JSPatch. Because ATT&CK provides no official detection text for this object, use the related DET0618 detection strategy as a prompt to build local analytics around runtime code retrieval and execution, while accounting for legitimate hot patching, app update, and content delivery behaviors. Relationship context shows this behavior is associated with multiple Android malware families, Android/iOS malware or riskware, and the Windshift group, but local detection should be based on observed app behavior rather than attribution assumptions.
Likely telemetry
- Mobile device management or enterprise mobility inventory showing Android and iOS versions, installed applications, app provenance, and update posture
- Mobile threat defense or endpoint telemetry capable of observing app network activity and runtime behavior
- Network logs for mobile devices or managed mobile traffic, including destinations used by apps after installation
- Application analysis results that identify dynamic loading, downloaded native/Dalvik code, WebView JavaScript interface exposure, or iOS hot-patching frameworks
- Mobile application allowlist/blocklist decisions and app store/reputation evidence
Detection direction
- Confirm whether current mobile security tooling can distinguish normal app content updates from downloaded executable code or script execution after install.
- Tune analytics for apps that retrieve code-like payloads from remote locations and then load or execute them, especially where the original package did not contain the observed functionality.
- On Android, validate coverage for native code loading, Dalvik code loading, and WebView JavascriptInterface abuse patterns referenced by ATT&CK.
- On iOS, review whether enterprise controls or app assessments can identify third-party runtime patching libraries such as JSPatch where relevant.
- Account for false positives from legitimate remote configuration, content delivery, analytics SDKs, and authorized hot patching; require behavioral context before escalating.
Mitigation priorities
- Keep mobile operating systems current, aligning with ATT&CK mitigation M1006, because newer OS versions may include security architecture improvements and blocks against observed techniques.
- Strengthen mobile application governance: restrict high-risk or unapproved apps on managed devices and require risk review for apps that dynamically load code.
- Use mobile threat detection or application vetting where business risk justifies runtime behavior assessment, not only static package review.
- Require additional scrutiny for apps used in sensitive roles, regulated data access, executive communications, or operational technology-adjacent workflows.
- Define IR playbooks for suspected mobile runtime code loading, including device isolation, app removal decisions, evidence preservation, and credential/session review where business apps are involved.
Additional notes and limits
The strongest decision point is whether the organization can observe post-install mobile app behavior. ATT&CK links this technique to numerous mobile software entries including ZergHelper, BrainTest, RCSAndroid, YiSpecter, SpyDealer, Judy, Skygofree, Exodus, Dvmap, Anubis, Triada, Bread, EventBot, Cerberus, Mandrake, WolfRAT, Zen, Desert Scorpion, ViperRAT, eSurv, and CarbonSteal, plus the Windshift group. These relationships show the technique’s relevance across mobile riskware, spyware, banking trojans, adware, and surveillanceware, but they do not prove activity in any specific environment.
ATT&CK lists no tactics and provides no official detection procedure for T1407 in the supplied fields. Detection feasibility depends heavily on mobile platform constraints, device ownership model, MDM/MTD coverage, network visibility, app vetting depth, and whether devices are managed. This take does not assert active exploitation, customer exposure, or guaranteed detection.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Download New Code at Runtime
Adversaries may download and execute dynamic code not included in the original application package after installation. This technique is primarily used to evade static analysis checks and pre-publication scans in official app stores. In some cases, more advanced dynamic or behavioral analysis techniques could detect this behavior. However, in conjunction with Execution Guardrails techniques, detecting malicious code downloaded after installation could be difficult.
On Android, dynamic code could include native code, Dalvik code, or JavaScript code that utilizes Android WebView’s `JavascriptInterface` capability.
On iOS, dynamic code could be downloaded and executed through 3rd party libraries such as JSPatch. [1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G0112: Windshift
S9004: Crocodilus
Crocodilus is an Android banking Trojan that was discovered in March 2025. Crocodilus targeted users worldwide, including Turkey, Poland, Argentina, Brazil, Spain, the United States, Indonesia and India. Crocodilus has been customized based on the target location. For example, Crocodilus mimicked major Turkish and Spanish banks for users in Turkey and Spain, while users in Poland saw Facebook advertisements that promoted Crocodilus to claim bonus points.[1][2]
S0424: Triada
S0420: Dvmap
S0506: ViperRAT
S1055: SharkBot
S0505: Desert Scorpion
Desert Scorpion is surveillanceware that has targeted the Middle East, specifically individuals located in Palestine. Desert Scorpion is suspected to have been operated by the threat actor APT-C-23.[1]
There are multiple close variants of Desert Scorpion, such as VAMP[2], GnatSpy[3], FrozenCell and SpyC23, which add some additional functionality but are not significantly different from the original malware.
S1094: BRATA
BRATA (Brazilian Remote Access Tool, Android), is an evolving Android malware strain, detected in late 2018 and again in late 2021. Originating in Brazil, BRATA was later also found in the UK, Poland, Italy, Spain, and USA, where it is believed to have targeted financial institutions such as banks. There are currently three known variants of BRATA.[1][2][3]
S1079: BOULDSPY
S0478: EventBot
EventBot is an Android banking trojan and information stealer that abuses Android’s accessibility service to steal data from various applications.[1] EventBot was designed to target over 200 different banking and financial applications, the majority of which are European bank and cryptocurrency exchange applications.[1]
S0535: Golden Cup
Golden Cup is Android spyware that has been used to target World Cup fans.[1]
S0432: Bread
Bread was a large-scale billing fraud malware family known for employing many different cloaking and obfuscation techniques in an attempt to continuously evade Google Play Store’s malware detection. 1,700 unique Bread apps were detected and removed from the Google Play Store before being downloaded by users.[1]
S0539: Red Alert 2.0
Red Alert 2.0 is a banking trojan that masquerades as a VPN client.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.5 | Current bundle | f961c0013166… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]FireEye-JSPatch
Jing Xie, Zhaofeng Chen, Jimmy Su. (2016, January 27). HOT OR NOT? THE BENEFITS AND RISKS OF IOS REMOTE HOT PATCHING. Retrieved December 9, 2016.
Open source URL - [2]ThreatFabric_Crocodilus_March2025
ThreatFabric. (2025, March 28). Exposing Crocodilus: New Device Takeover Malware Targeting Android Devices. Retrieved November 24, 2025.
Open source URL - [3]Google Triada June 2019
Lukasz Siewierski. (2019, June 6). PHA Family Highlights: Triada. Retrieved July 16, 2019.
Open source URL - [4]SecureList DVMap June 2017
R. Unuchek. (2017, June 8). Dvmap: the first Android malware with code injection. Retrieved December 10, 2019.
Open source URL - [5]Lookout ViperRAT
M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020.
Open source URL - [6]nccgroup_sharkbot_0322
RIFT: Research and Intelligence Fusion Team. (2022, March 3). SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store. Retrieved January 18, 2023.
Open source URL - [7]Lookout Desert Scorpion
A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.
Open source URL - [8]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [9]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [10]lookout_bouldspy_0423
Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.
Open source URL - [11]Cybereason EventBot
D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.
Open source URL - [12]Symantec GoldenCup
R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.
Open source URL - [13]Google Bread
A. Guertin, V. Kotov, Android Security & Privacy Team. (2020, January 9). PHA Family Highlights: Bread (and Friends) . Retrieved April 27, 2020.
Open source URL - [14]Sophos Red Alert 2.0
J. Chandraiah. (2018, July 23). Red Alert 2.0: Android Trojan targets security-seekers. Retrieved December 14, 2020.
Open source URL - [15]Threat Fabric Cerberus
Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.
Open source URL - [16]Android 10 Execute
Android Developers. (n.d.). Behavior changes: all apps - Removed execute permission for app home directory. Retrieved September 20, 2019.
Open source URL - [17]Lookout Uyghur Campaign
A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.
Open source URL - [18]Talos GPlayed
V. Ventura. (2018, October 11). GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020.
Open source URL - [19]Lookout FrozenCell
Michael Flossman. (2017, October 5). FrozenCell: Multi-platform surveillance campaign against Palestinians. Retrieved November 11, 2020.
Open source URL - [20]ZimperiumGupta_RatMilad_Oct2022
Gupta, N. (2022, October 5). We Smell A RatMilad Android Spyware. Retrieved August 27, 2025.
Open source URL - [21]Google Security Zen
Siewierski, L. (2019, January 11). PHA Family Highlights: Zen and its cousins . Retrieved July 27, 2020.
Open source URL - [22]SWB Exodus March 2019
Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved November 17, 2024.
Open source URL - [23]PaloAlto-SpyDealer
Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018.
Open source URL - [24]Lookout-BrainTest
Chris Dehghanpoor. (2016, January 6). Brain Test re-emerges: 13 apps found in Google Play Read more: Brain Test re-emerges: 13 apps found in Google Play. Retrieved December 21, 2016.
Open source URL - [25]CheckPoint-Judy
CheckPoint. (2017, May 25). The Judy Malware: Possibly the largest malware campaign found on Google Play. Retrieved September 18, 2018.
Open source URL - [26]TrendMicro-RCSAndroid
Veo Zhang. (2015, July 21). Hacking Team RCSAndroid Spying Tool Listens to Calls; Roots Devices to Get In. Retrieved December 22, 2016.
- [27]SecureList BusyGasper
Alexey Firsh. (2018, August 29). BusyGasper – the unfriendly spy. Retrieved October 1, 2021.
Open source URL - [28]Kaspersky-Skygofree
Nikita Buchka and Alexey Firsh. (2018, January 16). Skygofree: Following in the footsteps of HackingTeam. Retrieved September 24, 2018.
Open source URL - [29]paloalto_yispecter_1015
Claud Xiao. (2015, October 4). YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs. Retrieved March 3, 2023.
Open source URL - [30]cyble_chameleon_0423
Cyble Research & Intelligence Labs. (2023, April 13). Banking Trojan targeting mobile users in Australia and Poland. Retrieved August 16, 2023.
Open source URL - [31]CYBERWARCON CHEMISTGAMES
B. Leonard, N. Mehta. (2019, November 21). The Secret Life of Sandworms. Retrieved December 31, 2020.
Open source URL - [32]Trend Micro Anubis
K. Sun. (2019, January 17). Google Play Apps Drop Anubis, Use Motion-based Evasion. Retrieved January 20, 2021.
Open source URL - [33]Bitdefender Mandrake
R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020.
Open source URL - [34]Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL - [35]Xiao-ZergHelper
Claud Xiao. (2016, February 21). Pirated iOS App Store’s Client Successfully Evaded Apple iOS Code Review. Retrieved December 12, 2016.
- [36]WhiteOps TERRACOTTA
Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020.
Open source URL - [37]lookout_abstractemu_1021
P Shunk, K Balaam. (2021, October 28). Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign. Retrieved February 6, 2023.
Open source URL - [38]Palo Alto HenBox
A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.
Open source URL - [39]Lookout eSurv
A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.
Open source URL - [40]BlackBerry Bahamut
The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.
Open source URL - [41]FireEye-JSPatch
Jing Xie, Zhaofeng Chen, Jimmy Su. (2016, January 27). HOT OR NOT? THE BENEFITS AND RISKS OF IOS REMOTE HOT PATCHING. Retrieved December 9, 2016.
Open source URL - [42]NIST Mobile Threat CatalogueAPP-20Open source URL
- [43]NIST Mobile Threat CatalogueAPP-20Open source URL
- [44]mitre-attackT1407Open source URL
- [45]mitre-attackT1407Open source URL
- [46]Lookout Uyghur Campaign
A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.
Open source URL - [47]Lookout Uyghur Campaign
A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.
Open source URL - [48]Lookout Uyghur Campaign
A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.