What tactics and techniques does APT-C-23 use?

How APT-C-23 Operates Across Mobile Phishing and Credential Theft

APT-C-23 is best understood as a mobile-first intrusion pattern rather than a single trick. Its tactics combine social engineering, malicious links, fake apps and account capture, with messaging platforms acting as the delivery and persistence layer. That mix matters because the initial lure, the payload and the follow-on access are all designed to look like ordinary mobile activity.

One useful way to read this group is as a campaign that blends threat actor group intelligence with phishing and credential theft tradecraft. The first-stage objective is usually to convert trust in a contact, chat thread or mobile app store path into execution or login capture.

The techniques implied by the question are the ones defenders should expect to see in sequence: lure delivery, user interaction, credential capture, token or session abuse, and then continued access through the same messaging or account ecosystem. That sequence is more important than any single indicator because the group’s value comes from chaining simple actions into a durable compromise.

Why Messaging Apps and Fake Apps Are Effective in This Campaign

Messaging applications are attractive to operators because they collapse trust, urgency and execution into one channel. A link received in chat can bypass some of the suspicion users apply to email, and a fake app can look like a normal update, regional utility or chat companion. Those are classic phishing techniques, but tuned for mobile behaviour rather than desktop workflows.

Fake apps also work well when users are willing to grant permissions quickly, install outside official stores, or approve prompts without reading them carefully. Once installed, a malicious app can harvest contacts, read messages, intercept one-time codes, or relay login prompts to the operator. That makes the app itself only one part of the intrusion path, the account it can reach is the real prize.

Account capture extends the value of the initial phish because messaging services are both a communications tool and a trust anchor. If an attacker can take over the account, they can reuse the victim’s identity to send new lures, maintain access, and broaden the campaign through the victim’s social graph.

What Defenders Should Verify First on Mobile-Linked Accounts

The first verification step is exposure, not attribution. Confirm which users, devices and accounts could plausibly have interacted with suspicious links, sideloaded apps, or login prompts tied to messaging services. The practical question is whether the compromise path involved the device, the account, or both, because response actions differ depending on where control was lost.

It is also useful to compare the pattern with other credential-driven intrusions. For example, Microsoft Midnight Blizzard breach shows how weak or legacy authentication can let an attacker turn a single account weakness into broad access, while Salt Typhoon telecom intrusions 2025 illustrates how stolen credentials can support persistence and repeated reuse. The common lesson is that login artefacts and session behaviour often reveal more than the original lure.

For APT-C-23 style activity, inspect installation sources, mobile permissions, recent authentications, recovery-channel changes and unusual message forwarding or account-linking events. If suspicious login activity appears on an account tied to messaging services, treat the account as a potential pivot point rather than a standalone user issue.

Risk and Threat Considerations

APT-C-23’s main risk is that mobile trust boundaries are looser than enterprise perimeter controls, so a successful phish can become both a device compromise and an account compromise. Messaging services amplify that risk because they provide an easy path for impersonation, repeat delivery and social-engineering reuse across contacts.

Failure mechanism: A user trusts a message, installs a malicious app or follows a link, then the attacker captures credentials, tokens or account access and uses the compromised channel to sustain the campaign.

Impact: The attacker can harvest data, hijack conversations, spread new lures from a trusted account and preserve access long enough to make detection harder and response slower.

Practitioner Guidance

What to prioritise: Start with account and session containment before chasing the full malware story. If the messaging account is still active, revoke active sessions, reset credentials, and review linked devices, recovery options and forwarding settings first.

What to verify: Check whether the suspicious app came from an approved store, whether any permissions are excessive for its function, and whether login events align with the user’s normal device, location and timing profile. A mismatch there is often a stronger signal than the lure itself.

Practitioner takeaway: The key judgement is to treat mobile phishing as an access problem, not just a user-awareness problem, because the attacker’s objective is usually to turn one trusted chat or app interaction into durable account control.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?