T1476: Deliver Malicious App via Other Means

An adversary technique for distributing a malicious or trojanized application outside of an authorized app store.

Why It Matters

This is the delivery mechanism behind a large share of real-world mobile supply-chain and sideloading attacks — understanding it explains why supply chain hygiene (M2) matters even for apps that never leave an official store themselves.

Application to Application Security

Relevant where an organization distributes internal or enterprise apps outside a public store (MDM, sideloading, ad hoc distribution) — the same delivery risk that public-store review processes are designed to catch is absent in those channels.

Relation to Software Development

Engineering teams building enterprise or B2B mobile apps often rely on sideloaded or MDM-distributed builds by design — worth an explicit integrity-verification step precisely because store-level review isn't in the loop.

How Strata Surfaces This

Strata's supply-chain checks (dependency CVE scanning, unmaintained-component detection) reduce the chance a distributed build itself contains a compromised third-party component, complementing — not replacing — distribution-channel controls.

Developer guidance

Verify build signing and distribution integrity explicitly for any app shipped outside a public app store, and treat MDM/sideloaded distribution channels as needing the same rigor as store submission.

Management guidance

Enterprise-distributed apps skip a layer of external review that public-store apps get by default — internal review processes should account for that gap.

Related OWASP Items
MITRET1476Deliver Malicious App via Other MeansSource ↗