Phones receive phishing over more channels than any other endpoint, and most of those channels sit outside the email gateway and EDR that protect the desktop. MITRE ATT&CK for Mobile tracks this as T1660 Phishing, an Initial Access technique listed for Android and iOS. ATT&CK names the mobile forms: email with malicious attachments or links, third-party services such as social media, SMS (smishing), QR codes (quishing), and phone calls and voicemail (vishing), including AI voice cloning. It notes that the small screen makes it harder to spot differences between genuine and fake sites. This page covers the public cases, the controls that work on each platform, MITRE's detection analytics and response. The desktop technique is in the MITRE ATT&CK T1566 Phishing guide and the matrix in the MITRE ATT&CK for Mobile Guide.
Key takeaways
- Two outcomes, two defences. Mobile phishing either installs an app (mostly Android sideloading) or steals credentials and sessions (both platforms); block installs with device policy and stop credential theft with phishing-resistant authentication.
- QR codes move the attack to the phone on purpose. The FBI's January 2026 FLASH on Kimsuky describes QR codes in email that push victims onto phones outside email filtering, URL scanning and EDR.
- Help desks are a target. ATT&CK records Scattered Spider sending SMS to employee phones that led to fake login portals; vishing of executives and help desks is named in the technique itself.
- Network filtering is the main technical control. ATT&CK's M1058 notes that some mobile security products use a loopback VPN to block known phishing sites.
- Passkeys end the credential half. A passkey cannot be typed into a fake page, which removes most of the value of a smishing or quishing login lure.
Procedure examples in ATT&CK for Mobile
ATT&CK v20 lists more than fifteen groups and malware families for T1660. A representative set:
| Group or software | Channel | What ATT&CK records |
|---|---|---|
| BITTER (G1002) | SMS, WhatsApp, social media | Delivered malicious applications via shortened URLs |
| Kimsuky (G0094) | Email with QR codes | Phishing emails impersonating legitimate people, with malicious QR codes to harvest credentials |
| Sandworm Team (G0034) | SMS | SMS-based phishing with malicious links |
| Scattered Spider (G1015) | SMS | SMS to employee phone numbers linking to a fake credential harvesting login portal |
| FluBot (S1067) | SMS | Distributed via malicious links in SMS messages; Europol coordinated a takedown with ten countries in 2022 |
| NGate (S9040) | Email, SMS, fake bank sites | Delivered through links and sites mimicking Czech banks |
| Pegasus for iOS (S0289) | SMS | Distributed via malicious links in SMS messages |
| GodFather (S1231) | Fake notifications | Generated fake notifications to lure victims to phishing pages |
Where a lure delivers an exploit rather than an app, see the Mobile T1658 Exploitation for Client Execution guide; for apps delivered outside the stores, the Mobile T1476 Deliver Malicious Application via Other Means guide. For the actor behind several help desk intrusions see the Scattered Spider Threat Actor Profile; for the malware families, the Android Banking Trojans Guide.
Channels and the controls that fit them
| Channel | Typical goal | Controls |
|---|---|---|
| SMS and chat apps (smishing) | Malware install link or credential page | Block unknown sources on Android, URL filtering, report-junk workflow, passkeys |
| QR codes (quishing) | Credential page or session theft, moving from desktop to phone | MDM or security tools that check QR-linked URLs, phishing-resistant MFA, out-of-band verification. See the QR Code Phishing (Quishing) Guide |
| Voice calls and voicemail (vishing) | Credentials, MFA codes, help desk resets | Call-back verification, strict help desk identity proofing. See the Vishing and Help Desk Social Engineering Awareness Guide |
| Email on the phone | Attachment, link, credential page | Same email filtering as desktop, plus on-device URL checks |
| Social media and messaging platforms | Trojanised app downloads | App install restrictions, managed app catalogue |
| Push notifications from websites | Fake alerts leading to phishing pages | Browser notification permission policy, user guidance |
Platform controls on Android and iOS
Android
- Stop sideloaded payloads: on managed devices, block installs from unknown sources and keep Play Protect app verification on. Play Protect scans all installed apps daily, checks apps installed from outside Google Play against known samples, removes the most dangerous apps and disables less severe ones. See the Android Enterprise Security Guide.
- Limit dangerous permissions: phishing payloads such as banking trojans then ask for accessibility or notification access; review the permission policy in the Mobile App Permissions guide.
iOS and iPadOS
- Credential and session theft is the main risk: the iOS cases in ATT&CK are link delivery to an exploit (Pegasus) or credential harvesting; app installs are governed by App Store distribution and MDM.
- Reporting: Apple's guidance tells users to tap Report Junk in Messages for suspicious messages and to forward Apple-themed phishing to [email protected]. Add your own internal reporting route alongside it.
- High-risk users: Lockdown Mode disables links and link previews in Messages, which cuts off the one-click SMS path. See the Apple Lockdown Mode Guide.
Both platforms
- Network protection (M1058): MTD loopback VPN or a managed secure web gateway that blocks known phishing and newly registered domains.
- Phishing-resistant MFA: passkeys or FIDO2 security keys for corporate sign-in; the FBI Kimsuky FLASH recommends phishing-resistant MFA for all remote access and sensitive systems. See the Phishing-Resistant MFA Guide.
Detection and measurement
ATT&CK v20 detection strategy DET0684 gives one analytic per platform. MITRE's tunable defaults are a URL reputation threshold of 50 out of 100, a domain age of 30 days for newly registered domains and a 300 second window from navigation to the next event.
| Platform | Signal (from MITRE's analytics) | Data source |
|---|---|---|
| Android (AN1791) | Navigation to a flagged URL, then an APK file created in shared storage or a temporary directory, then first execution of the newly installed app, all inside the window | Secure web gateway or proxy logs; app vetting or forensic file traces; managed device process telemetry |
| iOS (AN1792) | Navigation to a flagged or unusual destination against a 30-day per-device Safari baseline, followed by command-and-control contact, or a change to protected configuration such as a new profile | Secure web gateway or proxy logs; Network Extension filter or per-app VPN flows; Apple MDM ProfileList and SecurityInfo queries |
On the identity side, correlate sign-ins from mobile user agents to new locations shortly after a blocked or reported link, and token replay from an unfamiliar network. See the Vishing and Smishing Guide for the user-facing programme.
Metrics:
- Percentage of managed devices with network phishing protection active.
- Phishing URLs blocked on mobile per month, by channel (SMS, email, QR, social).
- Percentage of workforce sign-ins using passkeys or security keys.
- Mobile phishing reports per month and median time from report to block.
- Help desk reset requests that fail identity verification.
Rolling out the controls
- Close app installs first: on corporate Android devices, block unknown sources; pilot with one group, check for business apps that were sideloaded, and move them to managed Google Play.
- Turn on network protection: deploy MTD web protection or a per-app VPN to a secure web gateway in monitor mode, review false positives for two weeks, then block.
- Move to phishing-resistant sign-in: start with administrators and the help desk, then executives, then everyone.
- Harden the help desk: require call-back to a number on record or manager approval before MFA resets.
- Set up reporting: one simple route for suspicious SMS, QR codes and calls that reaches the SOC.
- Rollback: keep the web filter's bypass list and the install policy's exceptions documented and time-limited.
Where identity fits
Most mobile phishing ends in an identity event: a stolen password, an approved push, a reset MFA factor or a replayed session token. Phishing-resistant credentials, short session lifetimes and device-bound tokens limit what a lure can steal. The same lures also target OAuth device-code and consent flows on phones; see the Device Code Phishing Guide.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| ATT&CK for Mobile | M1011 User Guidance, M1058 Antivirus/Antimalware | The mitigations ATT&CK maps to T1660 |
| ATT&CK Enterprise | T1566 Phishing | Desktop equivalent |
| NIST SP 800-53 Rev 5 | AT-2 Literacy Training and Awareness, SI-3 Malicious Code Protection, CM-11 User-installed Software, AC-19 Access Control for Mobile Devices | Awareness, filtering, install control, device conditions |
| NIST CSF 2.0 | PR.AT-01, PR.PS-05, DE.CM-09 | Training, preventing unauthorised software, monitoring |
Common failure patterns
- Email-only phishing programme: simulations and filters cover the inbox while SMS, QR and voice reach users untested.
- Personal devices with corporate access and no protection: a work profile without web protection leaves the browser used for sign-in unfiltered.
- Push or SMS codes as the strongest factor: smishing and vishing lures collect these in real time.
- Help desk resets on caller knowledge alone: the pattern ATT&CK records for Scattered Spider depends on it.
- No route to report a suspicious text: users delete it and the SOC never sees the campaign.
Practitioner checklist
- Block unknown-source installs and keep Play Protect verification on for managed Android devices.
- Deploy network phishing protection to managed phones and work profiles.
- Roll out passkeys or security keys, starting with privileged and help desk staff.
- Add SMS, QR and voice scenarios to awareness training.
- Require out-of-band verification for help desk MFA and password resets.
- Turn on Lockdown Mode for high-risk iPhone users.
- Tune MITRE's DET0684 windows and thresholds to your telemetry.
- Publish one reporting route for suspicious mobile messages and calls.
Standards and references
- MITRE ATT&CK: T1660 Phishing (Mobile)
- FBI: FLASH AC-000001-MW, North Korean Kimsuky actors leverage malicious QR codes in spearphishing
- NIST: Mobile Threat Catalogue AUT-9
- Google: Google Play Protect client protections
- Apple Support: Phishing, scam messages and fake support calls
- Apple: About Lockdown Mode
- Europol: Takedown of SMS-based FluBot spyware infecting Android phones
Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide, Mobile Malware Guide, Callback Phishing (TOAD) Guide, Mobile Threat Defense Buyer's Guide.