--- id: CP-093 slug: mobile-app-sideloading lang: en title: Mobile app sideloading description: An app installed outside the official stores can steal passwords and SMS messages. What employees see, how it works, what to do. canonical_url: https://startbrain.io/cyberpedia/en/articles/mobile-app-sideloading/ markdown_url: https://startbrain.io/cyberpedia/en/articles/mobile-app-sideloading.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Mobile app sideloading", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/mobile-app-sideloading/ (CC BY 4.0) wing: 1 theme: secure_devices reflex: cr-071 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/mobile-app-sideloading/ fr: https://startbrain.io/cyberpedia/fr/articles/sideloading-applications-hors-magasins/ de: https://startbrain.io/cyberpedia/de/articles/sideloading-apps-ausserhalb-der-stores/ es: https://startbrain.io/cyberpedia/es/articles/sideloading-aplicaciones-fuera-de-las-tiendas/ sources: - "n": 1 title: Masquerade as Legitimate Application, Technique T1444 - Mobile | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1444/ accessed: "2026-11-03" - "n": 2 title: Deliver Malicious App via Authorized App Store, Technique T1475 - Mobile | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1475/ accessed: "2026-11-03" - "n": 3 title: Cerberus, Software S0480 | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/software/S0480/ accessed: "2026-11-03" - "n": 4 title: "Input Capture: GUI Input Capture, Sub-technique T1417.002 - Mobile | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1417/002/ accessed: "2026-11-03" - "n": 5 title: Abuse Elevation Control Mechanism, Technique T1626 - Mobile | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1626/ accessed: "2026-11-03" - "n": 6 title: Hide Artifacts, Technique T1628 - Mobile | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1628/ accessed: "2026-11-03" - "n": 7 title: Input Capture, Technique T1417 - Mobile | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1417/ accessed: "2026-11-03" - "n": 8 title: Exploitation for Privilege Escalation, Technique T1404 - Mobile | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1404/ accessed: "2026-11-03" - "n": 9 title: BusyGasper, Software S0655 | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/software/S0655/ accessed: "2026-11-03" - "n": 10 title: Stored Application Data, Technique T1409 - Mobile | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1409/ accessed: "2026-11-03" --- # Mobile app sideloading On a work or personal phone, apps normally come from an official store, such as Google Play or the App Store. In this article, sideloading means installing an app by a route other than that store. Because mobile devices are often configured to accept only the authorized store [2], the attacker has to convince the victim to step outside that framework. MITRE describes the method: delivering malware by making it pass as a legitimate application [1]. This article takes the employee's point of view. The sources in the file are MITRE ATT&CK technical pages. They describe attackers' methods on Android and iOS, but contain no statistics on sideloading. ## In 30 seconds - Where it happens: on a website that asks you to install software, such as a fake installer [3], and on a device the attacker can physically access [9]. - What the attacker wants: to get a booby-trapped app installed, then get it granted broad rights in order to steal credentials and messaging data [3][4][9]. - The reflex: install only from the official store, and refuse any accessibility or device administrator request you did not look for yourself. - If it is already done: tell IT support without delay, and do not enter any password on that phone. ## Straight answers ### What is sideloading? It is installing an app without going through the device's authorized store. MITRE notes that mobile devices are often configured to allow installs only from an authorized store, such as the Google Play Store or Apple App Store [2]. An attacker who cannot place the app there has to convince the victim to get it elsewhere. ### Does the official store protect completely? Not completely: MITRE also describes the case where the attacker tries to place the malicious app in an authorized store, which allows it to be installed on the targeted devices [2]. The two MITRE pages on this subject carry a deprecation notice, but their content does describe both routes [1][2]. ### How is an employee led to install the app? The sources describe two ruses. The first is to make the software pass as a legitimate application, either by building it into a real application or by imitating its appearance [1]. The second goes through a website that invites you to install well-known software: the Cerberus trojan was distributed by sites that prompted the user to "install Adobe Flash Player" and downloaded a malicious APK [3]. ### What permissions does the app ask for? The sources cite accessibility and device administrator rights. Malicious apps abuse Android accessibility to find out which app is in the foreground [4]. For administrator rights, MITRE notes that apps very rarely need administrator rights and advises developers not to use this level of access [5]. ### Does the installed app stay visible? Not necessarily. MITRE explains that mobile systems have interfaces for hiding items such as an app's icon, and that attackers misuse them [6]. The page on input capture asks users to be wary of dangerous permissions, such as access to accessibility [7]. Other attackers exploit system flaws to obtain higher rights [8]. ### Is physical access to the device needed to infect it? In the documented case of BusyGasper, yes: this spyware infected its victims through physical access to the device [9]. ## Inside the attacker's head The attacker has an obstacle: the device is often configured to accept only the authorized store [2]. They need a credible pretext, and the sources give one: the name and appearance of a well-known app [4]. In the Cerberus case, it is a fake Adobe Flash Player installer [3]. Once the app is in place, its first goal is to obtain rights. Cerberus can inject inputs to grant itself additional permissions without user interaction and to prevent the app from being removed [3]. Collection and discretion come next: the attacker wants to read SMS messages, obtain contacts and the list of apps, then display fake screens on top of the apps the attacker has chosen [3]. The sources also describe attackers who target the system itself. Some exploit operating system flaws to move from a limited level of access to superuser (root) rights [8]. MITRE cites Pegasus for Android, which tries to exploit known Android flaws, and Pegasus for iOS, which exploits iOS flaws [8]. ## What you see on screen The victim first sees the page or message that invites them to install software. The sources in the file do not describe the device's installation warning, so that step is not detailed here. After installation, signs are rare, by design. MITRE explains that mobile systems offer interfaces for hiding items, such as an app's icon, and that these interfaces have legitimate uses that attackers misuse [6]. Cerberus hides its icon from the app drawer after its first launch [3]. BusyGasper lowers the screen brightness to the minimum and mutes the sound when it is active [9]. The most visible sign is a fake input prompt. MITRE explains that malicious apps imitate system interface elements to ask for sensitive information, and that the small screen of a mobile device makes it harder to check the context [4]. They can also send fake notifications that open a prompt when touched [4]. Finally, a prompt can appear on top of a legitimate app [4]. ## Under the hood The sources first describe overlay and accessibility, then persistence. - Overlay: the app draws a window on top of another one. It must hold the SYSTEM_ALERT_WINDOW permission, which MITRE says is granted automatically, at least under some conditions, to apps installed from Google Play [4]. Android 10 restricts launching an activity on top of another app [4]. Android 12 adds the HIDE_OVERLAY_WINDOWS permission, which makes it possible to hide these windows [7]. - Accessibility: a misuse makes it possible to know which app is in the foreground [4]. MITRE also points to apps that record keystrokes or capture information about screen gestures [7]. - Persistence: Cerberus disables Google Play Protect to avoid being discovered and removed later [3]. It can update its code on command [3]. MITRE also specifies that app sandboxing limits access to another app's data, except in three cases: unprotected external storage, internal storage with weak permissions, or obtaining root rights [10]. ## Case files ### Cerberus, a banking trojan for rent Cerberus is an Android banking trojan whose use is rented out on underground forums [3]. Its authors claim to have used it privately for two years before offering it for rent [3]. The references of the MITRE page include a ThreatFabric report from August 2019 and an article dated 16 August 2019 on fake Adobe Flash Player installers [3]. The software could read SMS messages, obtain contacts and the list of apps, generate fake notifications and launch overlay attacks against the apps chosen by the attacker [3]. ### BusyGasper, spyware (since May 2016) BusyGasper is Android spyware in use since May 2016 [9]. Fewer than ten victims are known, all apparently in Russia, and all infected through physical access to the device [9]. It can record sound and the camera, copy photos and browser history, and read SMS messages and data from WhatsApp, Viber and Facebook [9]. The page's reference is an article by Alexey Firsh dated 29 August 2018 [9]. ## What you do - Install only from the device's official store. An invitation to download a file or an "installer" from a website is suspect, even for well-known software [3]. - Refuse the accessibility, keyboard or administrator rights that an app requests without a clear reason. MITRE advises users to be wary of dangerous or intrusive permissions, such as registering a keyboard or accessing accessibility [7]. - Keep your phone locked and within reach: one documented case starts with physical access [9]. - Update the system: some protections, such as the Android 10 and Android 12 restrictions, depend on the version [4][7]. - On a managed device, the company can limit the permitted accessibility services through an explicit list, using a device management tool (EMM or MDM) [7]. ## Pitfalls The official store is not a complete guarantee [2]. A malicious app can also hide its icon, so the absence of a suspicious icon proves nothing [6]. MITRE writes that this type of technique cannot easily be countered by preventive controls, since it abuses system features [6]. A security setting that changes without your action is a signal: Cerberus disables Google Play Protect [3]. In that case, or if an unknown app asks for broad rights, contact support. ## Sources 1. MITRE ATT&CK, "Masquerade as Legitimate Application, Technique T1444 - Mobile | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1444/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Deliver Malicious App via Authorized App Store, Technique T1475 - Mobile | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1475/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Cerberus, Software S0480 | MITRE ATT&CK®". https://attack.mitre.org/software/S0480/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Input Capture: GUI Input Capture, Sub-technique T1417.002 - Mobile | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1417/002/ (accessed 3 November 2026) 5. MITRE ATT&CK, "Abuse Elevation Control Mechanism, Technique T1626 - Mobile | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1626/ (accessed 3 November 2026) 6. MITRE ATT&CK, "Hide Artifacts, Technique T1628 - Mobile | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1628/ (accessed 3 November 2026) 7. MITRE ATT&CK, "Input Capture, Technique T1417 - Mobile | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1417/ (accessed 3 November 2026) 8. MITRE ATT&CK, "Exploitation for Privilege Escalation, Technique T1404 - Mobile | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1404/ (accessed 3 November 2026) 9. MITRE ATT&CK, "BusyGasper, Software S0655 | MITRE ATT&CK®". https://attack.mitre.org/software/S0655/ (accessed 3 November 2026) 10. MITRE ATT&CK, "Stored Application Data, Technique T1409 - Mobile | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1409/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/mobile-app-sideloading/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.