Mobile ATT&CK Initial Access Tactic: How Attackers Get Onto Phones and How to Stop Them

Almost every mobile compromise in the ATT&CK record begins with the user installing something they should not, or tapping a link that was built for them, rather than with an exotic exploit. The Initial Access tactic in MITRE ATT&CK for Mobile (TA0027) describes the adversary "trying to get into your device" and covers the vectors used to gain a first foothold on an Android or iOS device. In ATT&CK v20 it holds nine techniques and three sub-techniques, from malicious app delivery and phishing to SIM swaps, lockscreen bypass and zero-click exploit chains. This hub ranks those techniques by what the procedure data says about real use, shows how they chain into the rest of the mobile matrix, and sets out the device management, mobile threat defence and forensic controls that block or reveal each one. It is written for mobile security engineers, endpoint and MDM administrators, SOC analysts and threat modellers. For the matrix as a whole, see the MITRE ATT&CK for Mobile Guide.

Key takeaways

• App delivery outside the store dominates. Deliver Malicious Application via Other Means (T1476) has 34 recorded software, group or campaign uses in the v20 Mobile dataset, nearly double the next technique, Phishing (T1660) with 18.
• Install controls beat detection for the top technique. ATT&CK lists no mitigation for T1476, so the decisive controls are platform settings: blocking unknown sources on Android and removing enterprise app trust on iOS through MDM.
• Exploitation is rare but high consequence. Drive-By Compromise (T1456) and Exploitation for Initial Access (T1664) are linked to spyware such as Pegasus for iOS and LightSpy, and the defence is fast patching plus Lockdown Mode for high-risk users.
• Two techniques attack the identity, not the handset. SIM Card Swap (T1451) is attributed to LAPSUS$ and Scattered Spider and turns SMS one-time codes into the attacker's codes, so phishing-resistant MFA is the real mitigation.
• Initial access rarely travels alone. Of the 64 entities that use an Initial Access technique, 46 also use Defense Evasion and 45 each use Discovery and Collection, so a blocked install stops a whole chain.

What Initial Access means on a phone

On a desktop, initial access often means a user running an attachment or an exposed server being exploited. Mobile operating systems change the shape of the problem. Apps are sandboxed, code must be signed, and the official stores review submissions, so an adversary has three broad routes: persuade the user to install or authorise something (T1476, T1660, T1661), break the platform's protections with an exploit (T1456, T1664, T1474), or bypass the device or its phone number altogether (T1461, T1458, T1451).

That split matters for defenders because each route has a different owner. Install routes are an MDM and user guidance problem. Exploit routes are a patching and hardening problem owned by whoever controls OS update policy. Physical and carrier routes are partly outside the device: the lockscreen policy, USB settings, and the identity team's choice of authenticators. Two techniques carry a second tactic in v20: Application Versioning (T1661) is also Defense Evasion, and Replication Through Removable Media (T1458) is also Lateral Movement.

Every Initial Access technique in ATT&CK v20

The table lists all current techniques and sub-techniques under TA0027, with the number of procedure examples (software, groups and campaigns with a "uses" relationship in the v20 Mobile STIX dataset), the ATT&CK mitigations mapped to each, and examples named by ATT&CK. All techniques apply to both Android and iOS.

Method: counts are distinct malware, tool, group and campaign objects with a non-revoked "uses" relationship to the technique in mobile-attack-20.0.json; sub-technique uses are counted separately from the parent. Procedure counts reflect what has been publicly reported and mapped, not true prevalence.

Where to start: ranked techniques for defenders

Ranking by procedure count alone would understate rare but severe techniques, so this ranking weighs reported use, the damage of a successful attempt and how much a single control reduces the risk.

1. T1476 Deliver Malicious Application via Other Means: the most used technique and the one with the cleanest control. On managed Android, the Android Management API policy field advancedSecurityOverrides.untrustedAppsPolicy defaults to DISALLOW_INSTALL; keep it there or limit installs to the personal profile. Since Android 8.0 the old global "Unknown sources" switch is a per-app "Install unknown apps" permission, which is why droppers ask for it. On supervised iOS, setting allowEnterpriseAppTrust to false removes the Trust Enterprise Developer button that sideloaded enterprise-signed apps rely on. See the APK sideloading guide.
2. T1660 Phishing: the main delivery mechanism for T1476 and for credential theft. SMS and messaging lures bypass email gateways entirely. The Twilio breach began with texts to employees posing as IT, leading to look-alike sign-in pages that relayed passwords and one-time codes in real time. See the Vishing and Smishing Guide.
3. T1451 SIM Card Swap: low device telemetry but direct identity impact. ATT&CK attributes it to LAPSUS$ and Scattered Spider. NIST SP 800-63B-4 treats SMS and voice out-of-band authentication as restricted and lists SIM change and number porting as risk indicators. See the SIM Swap Fraud Guide.
4. T1664 and T1456, exploitation and drive-by: few entries, but each is a full device compromise with no user decision to block. Operation Triangulation used an iMessage attachment against iOS versions up to 16.2, and Citizen Lab's analysis of the KISMET chain found 36 Al Jazeera staff phones compromised on iOS 13.5.1. Patching speed and Lockdown Mode are the controls.
5. T1474 Supply Chain Compromise: Google's analysis of Triada found it added to system images during production by a third party, and XcodeGhost spread through a trojanised copy of Xcode. Buyers control device sourcing and attestation; developers control their build toolchain.
6. T1661, T1461 and T1458: narrower but worth policy coverage. Application Versioning slips past one-off store review by turning malicious in a later update. Lockscreen Bypass and removable media need physical access and are answered by passcode, biometric class and USB policy.

How Initial Access chains into the rest of the matrix

Counting the tactics used by the 64 entities that have at least one Initial Access procedure in v20 shows what follows the foothold. Defense Evasion appears for 46, Discovery and Collection for 45 each, Command and Control for 37, Credential Access and Impact for 27 each, Exfiltration for 19 and Persistence for 17. The most common techniques used alongside initial access are SMS Messages collection (T1636.004, 35 entities), System Information Discovery (T1426, 33) and Web Protocols for command and control (T1437.001, 28).

Three chains recur in the procedure data:

• Banking trojan chain: smishing (T1660) leads to a sideloaded dropper (T1476), which requests Accessibility and SMS access, reads one-time codes (T1636.004) and overlays banking apps. ATT&CK records FluBot and GodFather using phishing and Anubis and Cerberus using delivery outside the store. See the Android Banking Trojans Guide.
• Mercenary spyware chain: a one-click or zero-click exploit (T1456, T1664) gives kernel-level access with no install prompt, followed by broad collection and exfiltration over the command channel. Pegasus for iOS and LightSpy are the ATT&CK examples. See the Commercial Spyware Guide.
• Account takeover chain: SIM swap (T1451) or a phishing lure aimed at a messaging account reaches the user's identity without touching the handset's code. The next step is often in cloud services, not on the phone, which is why mobile and identity telemetry have to meet.

Detection priorities and telemetry

ATT&CK v20 attaches a detection strategy to every Initial Access technique except T1476. Mobile telemetry is thinner than desktop telemetry, so the realistic sources are MDM and MTD signals, store and platform integrity checks, network logs and, after an incident, forensic acquisition.

MVT was released by the Amnesty International Security Lab in July 2021 for consensual forensic analysis of Android and iOS devices. Use it, with consent, when a high-risk user reports suspicious messages or a vendor threat notification. See the Mobile Verification Toolkit (MVT) guide and the Mobile Threat Defense Buyer's Guide for the MTD signal set.

Metrics that show coverage is working

• Sideload exposure: percentage of managed devices with unknown sources allowed or enterprise app trust enabled (target close to zero outside approved exceptions).
• Patch latency: median days from an Apple or Android security release to 90 per cent of fleet compliance.
• Phishing reach: malicious link blocks per 100 devices per month, and the share of reported smishing that was caught before a click.
• SMS dependency: number of privileged or workforce accounts still allowed SMS or voice codes.
• Integrity failures: devices failing attestation or reporting an unlocked bootloader, and time to quarantine them.

Prevention controls across Android and iOS

ATT&CK's mobile mitigations for this tactic are M1001 Security Updates, M1003 Lock Bootloader, M1004 System Partition Integrity, M1006 Use Recent OS Version, M1011 User Guidance, M1012 Enterprise Policy, M1013 Application Developer Guidance and M1058 Antivirus/Antimalware. The table translates them into platform settings.

For platform depth see the Android Enterprise Security Guide, the iOS and iPadOS Enterprise Security Guide and the Android Advanced Protection guide.

Rollout order

1. Inventory first: enrol corporate devices, record ownership model (company-owned, work profile, BYOD) and OS versions.
2. Report-only compliance: add rules for unknown sources, enterprise app trust, patch level and attestation in monitor mode for two weeks to size the exceptions.
3. Pilot ring: enforce install blocking and minimum OS on IT and security staff, then a business pilot group; keep an exception workflow for line-of-business apps.
4. Enforce fleet-wide: move non-compliant devices to restricted access through conditional access rather than wiping, so rollback is a policy change.
5. High-risk tier: offer Lockdown Mode or Advanced Protection to executives, staff who work with journalists and administrators, with a forensic path using MVT.
6. Retire SMS codes: migrate privileged users to phishing-resistant MFA, then the workforce.

Where identity fits

Two Initial Access techniques succeed without compromising the device's code. SIM Card Swap captures the phone number that many recovery flows trust, and phishing aimed at mobile users often harvests credentials and session tokens rather than installing anything. The FCC's 2023 order on SIM swap and port-out fraud requires US wireless carriers to use secure customer authentication and to notify customers of SIM change and port-out requests. Treat a phone number as an identifier, not an authenticator, and treat a SIM change as a risk event in the identity provider. See the Mobile Access Credentials guide.

Common failure patterns

• Allowing sideloading for one app, fleet-wide: a single line-of-business APK becomes the reason every device keeps "Install unknown apps" open. Distribute it through managed Google Play private apps instead.
• Training only for email phishing: the Twilio breach shows that SMS lures reach staff with no gateway in the path. Include smishing and messaging apps in awareness and reporting.
• Trusting store review as a one-time event: Application Versioning exists because a benign app can turn malicious in an update. Monitor permission changes and new network behaviour across versions.
• Treating BYOD as out of scope: unmanaged phones still receive work SMS codes and messaging lures. At minimum, require a work profile or app protection policy before granting access.
• Leaving SMS one-time codes on admin accounts: SIM swap and real-time relay phishing defeat them. Scattered Spider's use of SIM swaps is recorded in ATT&CK.
• Slow patching for spyware-grade exploits: exploit chains are fixed in emergency releases; a monthly patch cycle leaves weeks of exposure.

Framework mapping

Practitioner checklist

• Map every corporate and BYOD access path to an enrolment model and confirm which can install apps from outside the store.
• Enforce DISALLOW_INSTALL for untrusted apps on Android and disable enterprise app trust on supervised iOS.
• Keep Play Protect verification enforced and alert on devices where it is off.
• Set minimum OS and patch level baselines and measure time to compliance after each security release.
• Block known malicious domains on device through MTD or DNS filtering, including for SMS and messaging links.
• Offer Lockdown Mode or Android Advanced Protection to high-risk users, with a consent-based MVT triage path.
• Replace SMS and voice codes with passkeys or FIDO2 keys for privileged accounts first.
• Require strong passcodes, Class 3 biometrics and USB data restrictions on company-owned devices.
• Check device attestation and bootloader state before granting access to corporate resources.
• Link every alert to the technique page above so analysts follow the same playbook.

Standards and references

• MITRE ATT&CK: Initial Access, Mobile (TA0027)
• MITRE ATT&CK: Mobile Matrix
• NIST: SP 800-124 Rev 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise
• Google: Android Management API policies reference
• Apple: About Lockdown Mode
• NIST: SP 800-63B-4 Authentication and Authenticator Management
• Amnesty International Security Lab: Mobile Verification Toolkit documentation
• Google Security Blog: PHA Family Highlights, Triada

Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide, Mobile ATT&CK Persistence Tactic, Mobile Device Management Security Guide, Mobile Malware Guide.