MITRE ATT&CK for Mobile: Tactics, Mitigations, Use

Most security teams map their detections to ATT&CK Enterprise and leave the phones that hold MFA codes, email and messaging apps out of the picture. MITRE ATT&CK for Mobile is the separate knowledge base for Android and iOS: 12 tactics and, in v20.0, 78 techniques and 47 sub-techniques, with its own mitigations, detection strategies, groups and software. This guide explains how the Mobile matrix is organised, how it differs from Enterprise, how to use it with mobile device management (MDM), mobile threat defence (MTD) and app vetting data, and where teams go wrong. It is written for mobile security engineers, SOC and threat intelligence analysts and the architects who decide which mobile controls to buy. Figures on this page come from the official ATT&CK v20.0 Mobile dataset. For malware families and infection routes, see the Mobile Malware Guide.

Key takeaways

Mobile is its own domain. It has separate technique IDs (for example T1660 Phishing, T1453 Abuse Accessibility Features), its own 13 mitigations and its own tactic IDs, so Enterprise mappings do not carry over.
Android dominates the content. In v20.0, 123 of the 125 Mobile techniques and sub-techniques apply to Android and 90 to iOS.
Some techniques need no device access. MITRE describes the matrix as covering device access and network-based effects; SIM Card Swap (T1451) happens at the carrier, not on the phone.
Identity attacks run through the phone. SIM swapping, SMS phishing, accessibility abuse and application access token theft all target the credentials that protect corporate accounts.
Coverage depends on telemetry you may not have. Mobile detection strategies rely on MDM state, app vetting, MTD and network data, not endpoint process logs, so check what you actually collect before claiming coverage.

What ATT&CK for Mobile is and how it differs from Enterprise

The Mobile matrix on attack.mitre.org lists Android and iOS as its platforms and describes techniques involving device access and network-based effects, noting that adversaries can use some of them without access to the device. It is published alongside Enterprise and ICS in each ATT&CK release; the v20.0 Mobile collection was last modified on 13 October 2026.

Aspect	ATT&CK Enterprise v20	ATT&CK for Mobile v20.0
Platforms	Windows, macOS, Linux, cloud, SaaS, network devices, containers, ESXi	Android and iOS
Evasion tactics	Reorganised: Defense Impairment (TA0112) and a separate Stealth tactic	Single Defense Evasion tactic (TA0030), with 17 techniques
Mitigations	Enterprise M10xx set	13 mobile mitigations, from M1001 Security Updates to M1059 Do Not Mitigate
Main telemetry	Process, file, registry, authentication and network logs	MDM and EMM device state, app vetting and dynamic analysis, MTD findings, network and proxy logs
Threat actors	Hundreds of groups	20 groups and 128 software entries (126 malware, 2 tools), plus 3 campaigns
Typical owner	SOC and detection engineering	Mobile security, MDM administrators, app security and fraud teams

Some technique names repeat across domains but carry different IDs: Mobile T1481 Web Service is not Enterprise T1102 Web Service, and Mobile T1629 Impair Defenses is still current even though its Enterprise namesake was revoked in v20. Always record the domain with the ID. For the Enterprise matrix, see the MITRE ATT&CK Guide for Defenders; for industrial systems, the MITRE ATT&CK for ICS Guide.

The 12 tactics and what they look like on a phone

Tactic	Techniques	Representative techniques
TA0027 Initial Access	9	T1660 Phishing; T1451 SIM Card Swap; T1474 Supply Chain Compromise; T1476 Deliver Malicious Application via Other Means; T1661 Application Versioning; T1664 Exploitation for Initial Access
TA0041 Execution	4	T1623 Command and Scripting Interpreter; T1658 Exploitation for Client Execution; T1603 Scheduled Task/Job
TA0028 Persistence	8	T1624 Event Triggered Execution; T1541 Foreground Persistence; T1676 Linked Devices
TA0029 Privilege Escalation	3	T1404 Exploitation for Privilege Escalation; T1626 Abuse Elevation Control Mechanism
TA0030 Defense Evasion	17	T1407 Download New Code at Runtime; T1629 Impair Defenses; T1632 Subvert Trust Controls; T1633 Virtualization/Sandbox Evasion; T1670 Virtualization Solution
TA0031 Credential Access	6	T1417 Input Capture; T1453 Abuse Accessibility Features; T1517 Access Notifications; T1635 Steal Application Access Token
TA0032 Discovery	8	T1418 Software Discovery; T1426 System Information Discovery; T1422 System Network Configuration Discovery
TA0033 Lateral Movement	2	T1428 Exploitation of Remote Services; T1458 Replication Through Removable Media
TA0035 Collection	15	T1636 Protected User Data; T1430 Location Tracking; T1513 Screen Capture; T1638 Adversary-in-the-Middle
TA0037 Command and Control	9	T1437 Application Layer Protocol; T1481 Web Service; T1644 Out of Band Data; T1663 Remote Access Software
TA0036 Exfiltration	2	T1646 Exfiltration Over C2 Channel; T1639 Exfiltration Over Alternative Protocol
TA0034 Impact	10	T1582 SMS Control; T1640 Account Access Removal; T1471 Data Encrypted for Impact; T1643 Generate Traffic from Victim

Counts are top-level techniques in v20.0; several appear under more than one tactic (Input Capture is both Collection and Credential Access). Three recent additions show where the matrix is moving: T1670 Virtualization Solution (added March 2025) covers malware using Android virtualisation such as the Android Virtualization Framework to escape app sandboxes, for example to mimic a banking app; T1676 Linked Devices (May 2025) covers registering a victim's Signal or WhatsApp account to an adversary device, which ATT&CK records Star Blizzard doing with WhatsApp; and T1636.005 Accounts (September 2025) covers listing accounts through the Android AccountManager API or iOS Keychain services.

Mobile mitigations and what they mean in practice

Mobile ATT&CK has 13 mitigations. The number of technique relationships each one has in v20.0 shows where MITRE sees leverage: User Guidance and Use Recent OS Version dominate, which tells you that much mobile risk is reduced through platform currency and user behaviour rather than a single security product.

Mitigation	Techniques mapped	Practical control
M1011 User Guidance	49	Training on sideloading, accessibility prompts, SMS and voice lures; easy reporting route
M1006 Use Recent OS Version	35	Minimum OS version in MDM compliance and conditional access
M1012 Enterprise Policy	19	MDM or EMM policy: block unknown sources, restrict accessibility services, managed app configuration
M1001 Security Updates	18	Patch-level checks, retire devices that no longer receive updates
M1002 Attestation	13	Device and app integrity verdicts before access. The ATT&CK text still cites Android SafetyNet, which Google fully turned down in January 2025; use the Play Integrity API instead
M1010 Deploy Compromised Device Detection Method	9	Root and jailbreak detection in MDM or MTD, accepting that some methods are easy to evade
M1013 Application Developer Guidance	7	Secure coding for in-house apps; see the OWASP Mobile Top 10 Guide
M1004 System Partition Integrity; M1003 Lock Bootloader	7; 3	Verified boot and locked bootloaders, enforced through device procurement
M1014 Interconnection Filtering; M1009 Encrypt Network Traffic	2; 2	Carrier-side signalling filtering; TLS for app traffic
M1058 Antivirus/Antimalware	2	On-device scanning, including platform protections
M1059 Do Not Mitigate	1	Applied only to T1628.003 Conceal Multimedia Files, because the .nomedia file has legitimate uses

For MDM policy depth, see the Mobile Device Management Security Guide. NIST SP 800-124 Rev. 2 (May 2023) is the companion enterprise guidance and lists the NIST Mobile Threat Catalogue as supplemental material.

Detection engineering with mobile telemetry

Mobile v20.0 contains 124 detection strategies and 211 analytics built on 29 data components such as Application Permission, Permissions Request, System Settings, Protected Configuration, API Calls and Network Traffic Flow. They point to collectors that differ from Enterprise. The strategy for T1453 Abuse Accessibility Features, for instance, correlates app vetting and dynamic analysis traces (an accessibility service receiving events from many distinct apps, including targeted ones), MDM permission grant state from Android's DevicePolicyManager, and proxy or DNS metadata where enterprise inspection exists.

Telemetry source	What it shows	Techniques it supports
MDM or EMM inventory and compliance	OS and patch level, installed apps, device admin and accessibility grants, unknown-sources setting, root or jailbreak flags	T1404, T1453, T1476, T1626, T1629
MTD agent findings	Malicious apps, risky configurations, network attacks, phishing links	T1660, T1638, T1417, T1407
App vetting and dynamic analysis	Permissions requested, runtime API use, dynamic code loading	T1407, T1453, T1517, T1636
Identity provider and conditional access logs	Sign-ins from unmanaged or non-compliant devices, MFA method changes, token use from new locations	T1451, T1635, T1676
Network, DNS and proxy logs for managed traffic	C2 domains, unusual destinations, data volumes	T1437, T1481, T1646
Forensic backups and acquisitions	Artefacts of zero-click compromise	T1664, T1658

Operation Triangulation (ATT&CK campaign C0054) shows why the last row matters. Kaspersky reported on 1 June 2023 that it noticed suspicious traffic from iOS devices on its own corporate Wi-Fi, then analysed offline backups with the Mobile Verification Toolkit (mvt-ios). ATT&CK records the chain as zero-click iMessage exploits, the Binary Validator component and the TriangleDB implant. Network monitoring of managed Wi-Fi caught what on-device tooling could not. See the Mobile Forensics Guide.

Worked example: triaging an Android overlay alert

An MTD agent reports that a newly installed utility app on a work-profile Android phone has requested accessibility access and is drawing over a banking app. A Mobile ATT&CK mapping turns that single alert into a set of questions the analyst can answer in order:

Initial Access: how did the app arrive? A store install points to T1661 Application Versioning or a lure; a sideloaded APK points to T1476 Deliver Malicious Application via Other Means. MDM install source data answers this.
Credential Access: does it hold accessibility (T1453) or notification access (T1517)? If so, assume passwords and one-time codes typed or received since install are exposed.
Defense Evasion: does it load code after install (T1407) or hide its icon (T1628)? This decides whether a store takedown is enough.
Command and Control and Exfiltration: which domains did it reach over managed or MTD-inspected traffic (T1437, T1646)?
Identity response: revoke sessions and tokens for the user, reset factors registered on that device and check the identity provider for sign-ins from new devices.

Writing the triage runbook in these terms keeps responses consistent across analysts and makes post-incident coverage reviews straightforward.

Measuring it

Telemetry coverage: percentage of devices that access corporate data and report to MDM or MTD (target: all of them, enforced by conditional access).
Technique coverage: share of Mobile techniques relevant to your threat model with at least one tested detection or preventive control.
OS currency: percentage of devices on a supported OS and patch level, the control behind M1006 and M1001.
Risky grants: count of non-allowlisted apps holding accessibility or device admin rights.
Time to quarantine: minutes from MTD high-severity finding to conditional access block.

Using the matrix: threat modelling and coverage

Scope the fleet: list corporate-owned, work-profile and unmanaged personal devices, and which data and identities each can reach.
Select relevant groups and software: start from the 20 Mobile groups and the malware entries that target your sector and regions, plus the identity-focused techniques below. Threat intelligence teams should tag reports with Mobile IDs, not Enterprise ones.
Build a Navigator layer: score each technique for prevention (MDM policy, OS currency, attestation) and detection (MTD, vetting, identity logs). See the MITRE ATT&CK Coverage Mapping Guide.
Test, do not assume: validate MTD vendor mappings with authorised test apps or vendor-provided test cases in a lab device pool before trusting their claimed coverage.
Close gaps in rings: pilot new MDM restrictions such as blocking accessibility services for non-allowlisted apps on IT devices first, then expand; keep a documented rollback profile.
Review after each release: ATT&CK publishes Mobile changes with each version; re-run the layer when new techniques like T1670 or T1676 appear.

Choosing an approach: a small organisation with corporate iPhones can get far with MDM compliance, minimum OS version and phishing-resistant MFA, using the matrix as a checklist. A large or regulated organisation with Android BYOD and in-house apps needs MTD, app vetting and identity log correlation, and should own a maintained coverage layer. Buyers comparing MTD products can use Mobile technique coverage as an evaluation axis; see the Mobile Threat Defense Buyer's Guide.

Where identity fits

The phone is the second factor for most workforce and customer accounts, so several Mobile techniques are identity attacks in practice.

T1451 SIM Card Swap: ATT&CK records Scattered Spider using SIM swapping to bypass MFA and LAPSUS$ using it to gain access to victims' devices. Move high-value users off SMS and voice factors. See the SIM Swap Fraud Guide.
T1660 Phishing: Scattered Spider sent SMS phishing messages to employee phone numbers linking to fake login portals. See the Vishing and Smishing Guide.
T1453, T1417 and T1517: accessibility abuse, overlays and notification access capture passwords and one-time codes.
T1635 Steal Application Access Token: tokens stored by mobile apps are non-human credentials; short lifetimes and binding to the device reduce the value of theft.
T1676 Linked Devices: review linked device lists on messaging apps used for work, and include them in incident response.

Phishing-resistant authenticators remove most of the value of these techniques. See the Phishing-Resistant MFA Guide.

Common failure patterns

Using Enterprise IDs for mobile events: tagging an Android banking trojan with Enterprise techniques breaks reporting and hides gaps. Keep the Mobile domain in your schema.
Claiming coverage from an MTD datasheet: vendor mappings are rarely tested against your configuration; validate them in a lab pool.
Relying on deprecated attestation: integrations built on SafetyNet stopped working when Google turned it down in January 2025; check that in-house apps and access policies use Play Integrity.
Ignoring unmanaged devices: personal phones that receive SMS codes or hold work messaging accounts are in scope for SIM swap, smishing and linked device attacks even without MDM.
Treating a reboot as clean-up: Kaspersky found the Triangulation implant had no persistence but devices could be reinfected; its advice was a factory reset followed by an immediate update.
No forensic path: without a procedure for backups and analysis, a suspected zero-click compromise cannot be confirmed or ruled out.

Lessons from incidents

The Twilio breach of 2022 is T1660 in practice: text messages sent straight to employees' phones, posing as IT and linking to fake sign-in pages, bypassed corporate email filtering, and attackers captured one-time MFA codes in real time. A Mobile ATT&CK view would have flagged that SMS lures sat outside the email security stack and that SMS and app-based codes were phishable, pointing to phishing-resistant MFA and smishing reporting as the controls. See also the Lapsus$ Threat Actor Profile for SIM swap use.

Practitioner checklist

Add the Mobile domain to your ATT&CK schema, intelligence tagging and Navigator layers.
Build a coverage layer for the Mobile techniques in your threat model and test it.
Enforce minimum OS and patch level through MDM compliance and conditional access.
Block unknown sources and restrict accessibility and device admin grants to allowlisted apps.
Replace any SafetyNet dependencies with Play Integrity verdicts.
Move privileged and high-risk users to phishing-resistant MFA and off SMS codes.
Feed MTD, MDM and identity provider logs into the SIEM and correlate them.
Write a mobile forensic procedure, including backup and mvt-style analysis.
Include linked messaging devices and SIM swap checks in incident response.
Review the layer after each ATT&CK release.

MITRE ATT&CK for Mobile Guide: Mobile Tactics, Techniques and Defences Explained