A single crafted message, attachment or web page can run an attacker's code on a fully patched-looking phone, sometimes without the user tapping anything. MITRE ATT&CK for Mobile tracks this as T1658 Exploitation for Client Execution, an Execution technique listed for both Android and iOS. ATT&CK describes adversaries exploiting vulnerabilities in client applications to execute code, including one-click exploits delivered by SMS or iMessage, zero-click exploits that need no interaction, and, on iOS 13.4 and earlier, an AirDrop route through the Apple Wireless Direct Link interface. The Enterprise equivalent is covered in the MITRE ATT&CK T1203 Exploitation for Client Execution guide, and the wider matrix in the MITRE ATT&CK for Mobile Guide. This page is for mobile security, SOC and MDM teams: the public cases, what the two platforms give you to reduce exposure, MITRE's detection analytics, and how to respond.
Key takeaways
- Patch level is the main control. ATT&CK lists only two mitigations, Security Updates (M1001) and User Guidance (M1011), and only the first helps against zero-click delivery.
- The public cases are spyware. ATT&CK records Pegasus for iOS, LightSpy and Operation Triangulation using exploits that ran without user interaction.
- Messaging and browser processes are the targets. MITRE's analytics watch messaging, media and web content processes for unexpected child processes, faults and follow-on network connections.
- Reduce attack surface for high-risk users. Apple Lockdown Mode blocks most Messages attachment types, link previews and complex web technologies; Android Advanced Protection is the closest Android programme.
- Gate access on update state. Block or limit enterprise access from devices that are behind on security updates, which ATT&CK itself recommends under M1001.
Procedure examples in ATT&CK for Mobile
| Software or campaign | Platform | What ATT&CK records |
|---|---|---|
| Pegasus for iOS (S0289) | iOS | Can compromise iPhones running iOS 16.6 without any user interaction (citing Citizen Lab, 2022) |
| LightSpy (S1185) | iOS | Compromised iPhones running iOS 12.1 and 12.2 without user interaction (citing Kaspersky, 2020) |
| Operation Triangulation (C0054) | iOS | Threat actors sent iMessage messages carrying exploits that executed without user interaction, then used further exploits for privilege escalation (citing Kaspersky Securelist, 2023) |
Kaspersky's analysis of Operation Triangulation describes a malicious iMessage attachment that gave no visible sign to the victim, and an exploit chain built to work on iOS versions up to 16.2; Apple fixed the final hardware-related flaw in the chain in iOS 16.6. ATT&CK lists no Android procedure example for T1658 in v20, although the technique and MITRE's analytics cover both platforms. ATT&CK names Drive-By Compromise and Phishing as common delivery routes; see the Mobile T1456 Drive-By Compromise, Mobile T1660 Phishing and Mobile T1664 Exploitation for Initial Access guides. For the market behind these tools see the Commercial Spyware Guide.
How the delivery paths differ
| Delivery path | User action needed | Main platform controls |
|---|---|---|
| Link in SMS, iMessage or chat app (one-click) | Tap the link | Browser and OS updates, URL filtering through a managed VPN or secure web gateway, user guidance (M1011) |
| Attachment or message parsed on receipt (zero-click) | None | Security updates (M1001), Lockdown Mode on iOS, fewer messaging apps on high-risk devices |
| Malicious web content (renderer exploit) | Visit a page | Browser updates, Lockdown Mode web restrictions, web filtering |
| Wireless proximity protocol, e.g. AirDrop over AWDL (iOS 13.4 and earlier per ATT&CK) | None, attacker nearby | Supported OS versions only; retire devices that no longer receive updates |
Delivery overlaps with Vishing and Smishing Guide lures for one-click cases; zero-click cases look like nothing at all to the user, which is why the controls lean on patching and telemetry rather than training.
Platform controls on Android and iOS
iOS and iPadOS
- Software updates through MDM: Apple's deployment documentation describes the Software Update and Software Update settings declarative configurations for managing and enforcing updates, and Background Security Improvements for the latest iOS and iPadOS versions. Use enforcement deadlines for supervised devices. See the iOS and iPadOS Enterprise Security Guide.
- Lockdown Mode: available from iOS 16 and iPadOS 16. Apple states that it blocks most Messages attachment types other than certain images, video and audio, disables links and link previews in Messages, and blocks complex web technologies. Devices enrolled in MDM before Lockdown Mode was turned on stay managed, but new enrolment and new configuration profiles are blocked while it is on, so turn it on after enrolment. See the Apple Lockdown Mode Guide.
Android
- System and app updates through the DPC: use Android Enterprise system update policies and managed Google Play to keep the OS, WebView, browsers and messaging apps current, and report each device's security patch level to the compliance engine. See the Android Enterprise Security Guide.
- Advanced Protection: Google's device-level programme for at-risk users, covered in the Android Advanced Protection guide.
- Google Play Protect: scans installed apps daily and checks apps installed from outside Google Play. It addresses malicious apps rather than exploits in legitimate apps, so treat it as a complement to patching, not a substitute.
Detection and measurement
ATT&CK v20 detection strategy DET0629 gives one analytic per platform. Both correlate device management state, network connections and process telemetry from application vetting or managed device telemetry, and alert on a sequence inconsistent with the device baseline. MITRE warns not to infer process activity or payload content from management state alone.
| Platform | Signal (from MITRE's analytics) | Data source |
|---|---|---|
| Android (AN1699) | A media, browser or messaging process (for example mediaserver, Chromium or the messaging app) spawning an unexpected child process, followed within a short window by a connection outside the app's normal domains | DevicePolicyManager compliance and SecurityLog events where supported; Android Enterprise network logging (DnsEvent, ConnectEvent); execve() telemetry from vetting or managed telemetry |
| iOS (AN1700) | The WebContent or iMessage agent process (com.apple.WebContent, com.apple.imagent) showing an unexpected child or a fault-level memory fault in the Unified Log, then a connection outside Apple's own service ranges | Apple MDM DeviceInformation and SecurityInfo queries; Network Extension filter or per-app VPN flow metadata; device telemetry where available |
MITRE's tunable defaults are a 10 second window from media activity to child spawn and 30 seconds to command and control on Android, and 60 seconds from fault to connection on iOS. Patch lag (default 30 days on Android) is context only, not a primary signal. Android network logging is available to a device owner from Android 8.0 and to a work profile owner from Android 12, logs only TCP connections and DNS lookups through standard libraries, and covers only the work profile when used there. Real process-level telemetry on stock phones is rare, so most organisations rely on mobile threat defence products and on forensic checks. See the Mobile Threat Defense Buyer's Guide.
Metrics:
- Percentage of managed devices on the latest OS security release, and median days from Apple or Google release to install.
- Number of devices on OS versions that no longer receive security updates.
- Percentage of high-risk users with Lockdown Mode or Android Advanced Protection turned on.
- Exploit or suspicious-process alerts from MTD per month, and time to triage.
- Time from a vendor emergency update to enforced installation on high-risk devices.
Rolling out the controls
- Inventory: list every device with OS version, patch level and supervision or management mode; flag unsupported hardware.
- Set update rings: a small pilot ring installs within days, the main fleet within your patch window; emergency releases skip deferral.
- Gate access: add a minimum OS or patch level rule to conditional access; start in report-only mode, then block with a grace period.
- Protect high-risk users: enrol their devices first, then turn on Lockdown Mode or Advanced Protection; test the business apps they need and keep a documented way to switch it off for troubleshooting.
- Add telemetry: deploy MTD or network logging to the groups where it is lawful and proportionate, and route alerts to the SOC.
- Retire: replace devices that fall out of vendor support rather than accepting the risk indefinitely.
Responding to a suspected exploit
- Preserve first: do not wipe or update the device before evidence is taken. Take an iOS backup or sysdiagnose, or an Android acquisition, and record the OS version.
- Check for indicators: the Mobile Verification Toolkit, released by Amnesty International's Security Lab, supports consensual forensic analysis of iOS backups, filesystem dumps and sysdiagnose archives, and of Android data, against published indicators. See the Mobile Verification Toolkit (MVT) guide.
- Contain identity: revoke the device's sessions, tokens and certificates and re-enrol only after a clean rebuild.
- Follow the playbook: the Mobile Spyware Infection Response Playbook covers roles, escalation and when to involve specialist responders.
Where identity fits
A phone compromised through T1658 holds the user's session tokens, passkeys bound to the device, MDM enrolment identity and any API keys stored by apps. Treat the device identity as compromised: revoke refresh tokens and device certificates, rotate secrets that apps cached, and confirm that phishing-resistant credentials such as passkeys are re-registered on the rebuilt device. See the Mobile Access Credentials guide.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| ATT&CK for Mobile | M1001 Security Updates, M1011 User Guidance | The two mitigations ATT&CK maps to T1658 |
| ATT&CK Enterprise | T1203 Exploitation for Client Execution | Desktop equivalent |
| NIST SP 800-53 Rev 5 | SI-2 Flaw Remediation, AC-19 Access Control for Mobile Devices, SI-4 System Monitoring | Patching, mobile access conditions, telemetry |
| NIST CSF 2.0 | PR.PS-02, DE.CM-09, RS.MI-01 | Software maintenance, monitoring, containment |
Common failure patterns
- Deferral without an exception path: a 90-day deferral protects against bad updates but leaves the fleet exposed when Apple or Google ship an emergency fix.
- Old devices kept in service: hardware that no longer gets updates stays exploitable however good the MDM policy is.
- Lockdown Mode before enrolment: turning it on first blocks MDM enrolment and new profiles, so devices drop out of management.
- Wiping on suspicion: a factory reset destroys the evidence needed to confirm or rule out spyware.
- Training as the main control: user guidance does nothing against zero-click delivery.
Practitioner checklist
- Report OS version and security patch level for every managed device.
- Enforce updates with deadlines and an emergency path that skips deferral.
- Gate enterprise access on a minimum OS or patch level.
- Retire devices that no longer receive security updates.
- Turn on Lockdown Mode or Android Advanced Protection for high-risk users, after enrolment.
- Collect MTD or network logging telemetry where lawful, and tune MITRE's DET0629 windows.
- Write a preserve-before-wipe rule into the mobile incident process.
- Revoke tokens and device certificates when compromise is suspected.
Standards and references
- MITRE ATT&CK: T1658 Exploitation for Client Execution (Mobile)
- Apple: About Lockdown Mode
- Apple Platform Deployment: About software updates
- Android Developers: Network activity logging for device policy controllers
- Google: Google Play Protect client protections
- Amnesty International Security Lab: Mobile Verification Toolkit documentation
- Kaspersky Securelist: Operation Triangulation, the last hardware mystery
Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide, Commercial Spyware Guide, Mobile Communications Protection for High-Risk Individuals Guide, Mobile Device Management Security Guide.