Mobile T1646 Exfiltration Over C2 Channel: Limiting and Spotting Data Theft From Phones

Most mobile malware does not open a separate channel to steal data: it sends what it has collected back over the same connection it uses to take orders, usually ordinary HTTP or HTTPS. ATT&CK for Mobile v20 tracks this as Exfiltration Over C2 Channel (T1646), an Exfiltration (TA0036) technique on Android and iOS. ATT&CK's own detection guidance says the technique can be difficult to detect and that enterprises may be better served focusing on other stages of the attack. This page takes that advice seriously: it explains what the technique looks like, the procedure examples ATT&CK records, the limited network signals that do exist, and the controls earlier in the chain that decide how much data there is to steal. It is for mobile security engineers, SOC analysts and MDM administrators. For the wider matrix, see the MITRE ATT&CK for Mobile Guide.

Key takeaways

• It is the default exfiltration path. ATT&CK v20 lists more than 30 mobile malware families and campaigns using T1646, from banking trojans such as SharkBot and FluBot to spyware such as LightSpy and the PROMETHIUM campaign C0033.
• HTTP and HTTPS dominate. Most procedure examples send data with HTTP POST or PUT, with a few using SMTP or raw sockets, so the traffic looks like normal app traffic.
• ATT&CK maps no mitigation. The v20 data set has no mitigation object for T1646, and its detection analytics for both Android and iOS point defenders towards earlier stages.
• Collection controls decide the impact. Permissions, accessibility abuse, notification access and app install source determine what the malware can collect before it sends anything.
• Stolen tokens are the high-value payload. SharkBot exfiltrates captured credentials and NGate the victim's card PIN, so the response must include credential revocation, not only device clean-up.

What T1646 is

ATT&CK defines Exfiltration Over C2 Channel as stealing data by exfiltrating it over an existing command and control channel, with the stolen data encoded into the normal communications channel using the same protocol as the C2 traffic. There are no sub-techniques in v20. The enterprise counterpart is T1041. On mobile the C2 protocol is normally covered by Application Layer Protocol (T1437) and often Encrypted Channel (T1521), so in practice T1646 traffic inherits the properties of those techniques: HTTPS to a server the device already talks to.

The alternatives an adversary has are Exfiltration Over Alternative Protocol (T1639) and Out of Band Data (T1644). Choosing the existing channel keeps the number of network destinations low and avoids extra permissions.

Real cases from ATT&CK v20

Other families ATT&CK lists include Chameleon, BRATA, Triada, eSurv, GolfSpy, LightSpy, GodFather, Crocodilus, Drinik, Hornbill, RedDrop, FlyTrap, Fakecalls, VajraSpy, ViceLeaker, Pallas, RatMilad, BOULDSPY, Binary Validator and the Operation Dust Storm campaign (C0016). Banking malware patterns are covered in the Android Banking Trojans Guide and spyware in the Commercial Spyware Guide.

What you can and cannot see

ATT&CK v20's two analytics for T1646, one for Android and one for iOS, both state that the technique can be difficult to detect. The reasons are practical: the traffic is encrypted, the destination is already in use by the implant, and the device may be on a home or mobile network outside corporate inspection. What remains is metadata, where you have it.

The general approach to periodic C2 traffic is in the Beaconing and C2 Detection Guide; this page does not repeat it.

Controls that reduce what can be stolen

ATT&CK v20 maps no mitigation to T1646. Every control below is an NHI Mgmt Group recommendation aimed at the collection and C2 stages that precede exfiltration, using mitigation IDs ATT&CK applies to those stages.

Platform settings are covered in the Android Enterprise Security Guide and the iOS and iPadOS Enterprise Security Guide.

Where identity fits

The payloads in the table are frequently credentials: SharkBot's captured logins, CherryBlos' credentials read from pictures by OCR, NGate's PIN. Once these leave the device, cleaning the phone does not undo the theft. Mobile apps also carry machine credentials of their own: OAuth refresh tokens, API keys and, in poor builds, backend secrets. The Applebee's breach shows the extreme case, a database password inside an Android app that anyone could extract without malware at all. Keep backend secrets out of apps, use short-lived tokens bound to the device where possible, and include token revocation in mobile incident response. See Mobile Access Credentials.

Response when exfiltration is suspected

1. Scope the collection. List the permissions, accessibility and notification access the suspect app held; that tells you what could have been sent.
2. Preserve evidence. Capture gateway flow records and a consensual device backup or sysdiagnose before removal; see the Mobile Forensics Guide.
3. Contain the device. Mark it non-compliant, revoke corporate access and remove the app or wipe the work profile.
4. Revoke credentials. Reset passwords and revoke sessions and refresh tokens for every account used on the device; re-enrol MFA if SMS or authenticator apps were exposed.
5. Block infrastructure. Add the C2 domains and IPs to DNS and gateway block lists across the fleet.
6. Assess notification duties. If personal data left the device, the data protection team assesses notification obligations under the applicable law. The Mobile Spyware Infection Response Playbook covers the full sequence.

How to implement

1. Route managed traffic. Start with per-app VPN for corporate apps, then extend to device-wide VPN for fully managed devices.
2. Baseline per app. Record normal upload volume and destinations per managed app for a month.
3. Alert on deviations. Rare destinations and upload spikes from apps with no upload function; tune in report-only mode first.
4. Close collection paths. Enforce install source and sensitive access policies; quarantine rather than wipe while testing.
5. Rehearse credential revocation. Time how long it takes to revoke all tokens for a user's device.

Measuring it

• Percentage of managed apps whose traffic passes through an inspecting gateway.
• Number of devices with unapproved accessibility or notification access grants.
• Median time from suspect app detection to token revocation.
• Percentage of mobile apps in your portfolio with no long-lived secrets embedded.

Common failure patterns

• Looking only for a separate exfiltration channel. T1646 traffic goes to the C2 server already in use.
• No visibility on BYOD. Personal devices outside the gateway produce no flow records; rely on work profile separation and integrity gating instead.
• Treating removal as recovery. Uninstalling the app does not revoke stolen tokens or passwords.
• Allowing broad accessibility grants. Most of the high-value data in the procedure examples is collected through permissions that a policy could have refused.
• Secrets in app bundles. Embedded backend credentials turn any app compromise, or simple decompilation, into a backend compromise.

Framework mapping

Practitioner checklist

• Route managed app traffic through a per-app VPN or inspecting gateway.
• Baseline upload volume and destinations per managed app.
• Audit accessibility, notification access and SMS permission grants on Android.
• Block installs from unknown sources and keep Play Protect on.
• Separate corporate data with a work profile or managed apps.
• Gate corporate access on device integrity verdicts or MDM compliance.
• Remove long-lived secrets from your own mobile apps.
• Include token and session revocation in every mobile malware response.

Standards and references

• MITRE ATT&CK: Exfiltration Over C2 Channel, Mobile T1646
• MITRE ATT&CK: SharkBot (S1055)
• Google: Google Play Protect
• Android Developers: Play Integrity API integrity verdicts
• Android Help: Allow restricted settings
• Mobile Verification Toolkit documentation
• NIST: SP 800-53 Rev 5 Security and Privacy Controls

Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide · Data Exfiltration Guide · Command and Control (C2) Guide · Mobile Malware Guide