T1476: Deliver Malicious Application via Other Means
Adversaries may direct victims to download malicious applications via ways that avoid an authorized application store (e.g. Google Play Store or Apple App Store). For example, victims may be directed to downloading a malicious APK directly from a domain. Adversaries may wish to avoid placing malicious applications in an authorized application store due to increased potential risk of detection or other reasons.
Delivery methods for malicious applications include:
* Spearphishing Attachment: including the mobile application package as an attachment to an email * Spearphishing Link: including a link to the mobile application package within an email, text message (e.g. SMS, iMessage, WhatsApp, etc.), web site, QR code, or other means. * Third-Party Application Store: installing the mobile application package from a third-party application store, as opposed to an authorized app store that the device implicitly trusts as part of its default behavior. Third-party application stores may not apply the same level of scrutiny to applications as enforced by an authorized application store.[1][2][3]
Some Android malware comes with functionality to install additional applications, either automatically or when the adversary instructs it to.[4]
Security context for executives and security teams
T1476: Deliver Malicious Application via Other Means describes Adversaries may direct victims to download malicious applications via ways that avoid an authorized application store (e.g. Google Play Store or Apple App Store). For example, victims may be directed to downloading a malicious APK directly from a domain. Adversaries may wish to avoid placing malicious applications in an authorized application store due to increased potential risk of detection or other reasons. Delivery methods for malicious applications include: * Spearphishing Attachment: including the mobile appl...
Executive priority
T1476: Deliver Malicious Application via Other Means is an official MITRE ATT&CK technique. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate T1476: Deliver Malicious Application via Other Means by reviewing the official ATT&CK relationships, mapped tactics (initial-access), supported platforms (Android, iOS), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether T1476: Deliver Malicious Application via Other Means appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Deliver Malicious Application via Other Means
Adversaries may direct victims to download malicious applications via ways that avoid an authorized application store (e.g. Google Play Store or Apple App Store). For example, victims may be directed to downloading a malicious APK directly from a domain. Adversaries may wish to avoid placing malicious applications in an authorized application store due to increased potential risk of detection or other reasons.
Delivery methods for malicious applications include:
* Spearphishing Attachment: including the mobile application package as an attachment to an email * Spearphishing Link: including a link to the mobile application package within an email, text message (e.g. SMS, iMessage, WhatsApp, etc.), web site, QR code, or other means. * Third-Party Application Store: installing the mobile application package from a third-party application store, as opposed to an authorized app store that the device implicitly trusts as part of its default behavior. Third-party application stores may not apply the same level of scrutiny to applications as enforced by an authorized application store.[1][2][3]
Some Android malware comes with functionality to install additional applications, either automatically or when the adversary instructs it to.[4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Mobile | — | App Delivered via Web Download | App Delivered via Web Download revoked by this object. |
| Mobile | — | Abuse of iOS Enterprise App Signing Key | Abuse of iOS Enterprise App Signing Key revoked by this object. |
| Mobile | — | App Delivered via Email Attachment | App Delivered via Email Attachment revoked by this object. |
Groups, software, and campaigns
G0097: Bouncing Golf
Bouncing Golf is a cyberespionage campaign targeting Middle Eastern countries.[1]
G0070: Dark Caracal
Dark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012. [1]
G0112: Windshift
S0419: SimBad
SimBad was a strain of adware on the Google Play Store, distributed through the RXDroider Software Development Kit. The name "SimBad" was derived from the fact that most of the infected applications were simulator games. The adware was controlled using an instance of the open source framework Parse Server.[1]
S0403: Riltok
S0317: Marcher
S0432: Bread
Bread was a large-scale billing fraud malware family known for employing many different cloaking and obfuscation techniques in an attempt to continuously evade Google Play Store’s malware detection. 1,700 unique Bread apps were detected and removed from the Google Play Store before being downloaded by users.[1]
S0287: ZergHelper
ZergHelper is iOS riskware that was unique due to its apparent evasion of Apple's App Store review process. No malicious functionality was identified in the app, but it presents security risks. [1]
S0421: GolfSpy
GolfSpy is Android spyware deployed by the group Bouncing Golf.[1]
S0399: Pallas
Pallas is mobile surveillanceware that was custom-developed by Dark Caracal.[1]
S0506: ViperRAT
S9040: NGate
NGate is an Android malware that was first seen in November 2023 targeting Czech banks and Polish banks. NGate uses Near Field Communication (NFC) to relay a victim’s debit card and banking information from the compromised Android device to the adversary’s device, ultimately resulting in fraudulent ATM withdrawals by the adversary. NGate uses the legitimate tool called NFCGate, developed by students at the Technical University of Darmstadt, Germany.[1][2]
A new variant of NGate that abuses the legitimate application HandyPay, potentially with AI-generated code, has been observed targeting users in Brazil since at least November 2025. This variant is capable of performing NFC transfers like previous iterations with new functionality for capturing and exfiltrating the victim’s payment card PIN.[3]
S0303: MazarBOT
S0524: AndroidOS/MalLocker.B
AndroidOS/MalLocker.B is a variant of a ransomware family targeting Android devices. It prevents the user from interacting with the UI by displaying a screen containing a ransom note over all other windows. [1]
S0302: Twitoor
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 2.0 | Current bundle | c84cfb2213a8… | ||
| 19.2 | 1.2 | Older bundleDeprecated | 1203ffc044ba… | ||
| 19.1 | 1.2 | Older bundleDeprecated | 1203ffc044ba… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]IBTimes-ThirdParty
A Prasad. (2016, February 19). Danger lurks in third-party Android app stores. Retrieved November 8, 2018.
Open source URL - [2]TrendMicro-RootingMalware
Jordan Pan. (2016, February 10). User Beware: Rooting Malware Found in 3rd Party App Stores. Retrieved November 8, 2018.
Open source URL - [3]TrendMicro-FlappyBird
Veo Zhang. (2014, February 18). Flappy Bird and Third-Party App Stores. Retrieved November 8, 2018.
Open source URL - [4]android-trojan-steals-paypal-2fa
Lukáš Štefanko. (2018, December 11). Android Trojan steals money from PayPal accounts even with 2FA on. Retrieved July 11, 2019.
Open source URL - [5]NIST Mobile Threat CatalogueAUT-9Open source URL
- [6]NIST Mobile Threat CatalogueECO-13Open source URL
- [7]NIST Mobile Threat CatalogueECO-21Open source URL
- [8]mitre-attackT1476Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.