Adversaries may direct victims to download malicious applications via ways that avoid an authorized application store (e.g. Google Play Store or Apple App Store). For example, victims may be directed to downloading a malicious APK directly from a domain. Adversaries may wish to avoid placing malicious applications in an authorized application store due to increased potential risk of detection or other reasons. Delivery methods for malicious applications include: * Spearphishing Attachment: including the mobile application package as an attachment to an email * Spearphishing Link: including a link to the mobile application package within an email, text message (e.g. SMS, iMessage, WhatsApp, etc.), web site, QR code, or other means. * Third-Party Application Store: installing the mobile application package from a third-party application store, as opposed to an authorized app store that the device implicitly trusts as part of its default behavior. Third-party application stores may not apply the same level of scrutiny to applications as enforced by an authorized application store.(Citation: IBTimes-ThirdParty)(Citation: TrendMicro-RootingMalware)(Citation: TrendMicro-FlappyBird) Some Android malware comes with functionality to install additional applications, either automatically or when the adversary instructs it to.(Citation: android-trojan-steals-paypal-2fa)
MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.