What tactics and techniques does Roaming Mantis use?

What Roaming Mantis actually does at each stage

Roaming Mantis is not just a single malware family, it is a campaign pattern that combines lure, collection and delivery. The operator chain typically starts with mobile-oriented phishing and lookalike websites, then uses the victim’s interaction to capture credentials or steer the device toward malware installation. The practical signal for defenders is that user trust is being converted into an access path, not just into a click.

The campaign’s technique mix matters because each stage serves a different purpose. Phishing pages harvest login data, malicious sites can push redirects or prompts, and malware delivery extends the intrusion beyond the browser into the device itself. That means detection has to cover message, web and endpoint touchpoints together, rather than treating the activity as ordinary spam or a one-off phishing event.

Roaming Mantis also makes traffic redirection part of the intrusion path, which can turn a normal browsing or DNS flow into a control point for the attacker. If a user lands on a counterfeit login page or a rogue redirect chain, the attacker can use that moment either to steal credentials directly or to guide the victim into installing an app or payload that preserves later access.

How the phishing and traffic-redirection chain works

The lure usually depends on urgency, convenience or routine mobile behavior. SMS links, web links and browser redirects are effective because they exploit the low-friction way users open pages on phones and tablets. Once the victim follows the link, the attacker can present a page that looks legitimate enough to collect credentials or trigger a follow-on action such as an app install prompt.

Traffic redirection is especially useful to the operator because it lets the same infrastructure serve multiple purposes. A domain can behave like a credential trap for one visitor, a redirector for another, and a malware staging point for a third. That flexibility is why campaigns like Roaming Mantis are hard to judge by a single indicator and why lookalike domains and unusual DNS behavior are so important to watch.

Lookalike domains and hosted login pages are a common pattern because they let the campaign borrow trust from familiar brands while keeping the infrastructure disposable. Even when the page is simple, the real objective is often to collect reusable credentials or to push the user into an installation flow that expands the attacker’s control.

Why this campaign is more than credential phishing

Once credentials are harvested, the campaign can use them immediately or later, depending on what access is available. If the same password is reused elsewhere, the value of the theft increases sharply. If the mobile device is induced to install malicious code, the operator may gain a more persistent foothold than a basic phishing page would provide.

That is why Roaming Mantis should be treated as a blended threat: social engineering, malicious infrastructure and endpoint compromise are all part of the same operating model. The attacker does not need every technique to succeed in every case. A single successful click, redirect or install event may be enough to move from lure to compromise.

Risk and Threat Considerations

Roaming Mantis is risky because it combines trust abuse with follow-on technical control of the victim path. A successful lure can expose credentials, redirect traffic through attacker-controlled infrastructure or lead to malware installation, which expands impact from account compromise to device compromise and possible session or account reuse.

Failure mechanism: The campaign succeeds when users follow a mobile lure, accept a malicious redirect or interact with a counterfeit login or installation page, allowing the attacker to harvest credentials or deliver malware before the user recognises the deception.

Impact: The result can be account takeover, unauthorized traffic redirection, persistent device infection and downstream misuse of exposed credentials across other services or environments.

Practitioner Guidance

What to verify: Check whether suspicious SMS links, browser redirects or app-install prompts resolve to lookalike domains, and confirm whether DNS or router settings changed around the same time. If a login page was hosted on an unexpected domain, treat captured credentials as exposed even if no malware was confirmed.

Decision rule: If the campaign reached credential entry, prioritize password reset, session invalidation and reuse checking before assuming the event was only a phishing attempt. If the same device also showed installation prompts or redirection anomalies, escalate to device triage as well.

Practitioner takeaway: The key judgement is to treat the campaign as a multi-stage access path, not a single phishing page, because the defensive response changes once credentials, traffic control or device installation are all in play.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?