T1476: Deliver Malicious App via Other Means
An adversary technique for distributing a malicious or trojanized application outside of an authorized app store.
Why It Matters
This is the delivery mechanism behind a large share of real-world mobile supply-chain and sideloading attacks — understanding it explains why supply chain hygiene (M2) matters even for apps that never leave an official store themselves.
Application to Application Security
Relevant where an organization distributes internal or enterprise apps outside a public store (MDM, sideloading, ad hoc distribution) — the same delivery risk that public-store review processes are designed to catch is absent in those channels.
Relation to Software Development
Engineering teams building enterprise or B2B mobile apps often rely on sideloaded or MDM-distributed builds by design — worth an explicit integrity-verification step precisely because store-level review isn't in the loop.
How Strata Surfaces This
Strata's supply-chain checks (dependency CVE scanning, unmaintained-component detection) reduce the chance a distributed build itself contains a compromised third-party component, complementing — not replacing — distribution-channel controls.
Developer guidance
Verify build signing and distribution integrity explicitly for any app shipped outside a public app store, and treat MDM/sideloaded distribution channels as needing the same rigor as store submission.
Management guidance
Enterprise-distributed apps skip a layer of external review that public-store apps get by default — internal review processes should account for that gap.