Cyberpediaby Brain
ENDEFR

Mobile app sideloading

An app installed outside the official stores can steal passwords and SMS messages. What employees see, how it works, what to do.

In 30 seconds

Where it happens
On a website that asks you to install software, such as a fake installer3, and on a device the attacker can physically access9.
What the attacker wants
To get a booby-trapped app installed, then get it granted broad rights in order to steal credentials and messaging data349.
The reflex
Install only from the official store, and refuse any accessibility or device administrator request you did not look for yourself.
If it is already done
Tell IT support without delay, and do not enter any password on that phone.

What it is

On a work or personal phone, apps normally come from an official store, such as Google Play or the App Store. In this article, sideloading means installing an app by a route other than that store. Because mobile devices are often configured to accept only the authorized store2, the attacker has to convince the victim to step outside that framework. MITRE describes the method: delivering malware by making it pass as a legitimate application1.

This article takes the employee's point of view. The sources in the file are MITRE ATT&CK technical pages. They describe attackers' methods on Android and iOS, but contain no statistics on sideloading.

Straight answers

What is sideloading?

It is installing an app without going through the device's authorized store. MITRE notes that mobile devices are often configured to allow installs only from an authorized store, such as the Google Play Store or Apple App Store2. An attacker who cannot place the app there has to convince the victim to get it elsewhere.

Does the official store protect completely?

Not completely: MITRE also describes the case where the attacker tries to place the malicious app in an authorized store, which allows it to be installed on the targeted devices2. The two MITRE pages on this subject carry a deprecation notice, but their content does describe both routes12.

How is an employee led to install the app?

The sources describe two ruses. The first is to make the software pass as a legitimate application, either by building it into a real application or by imitating its appearance1. The second goes through a website that invites you to install well-known software: the Cerberus trojan was distributed by sites that prompted the user to "install Adobe Flash Player" and downloaded a malicious APK3.

What permissions does the app ask for?

The sources cite accessibility and device administrator rights. Malicious apps abuse Android accessibility to find out which app is in the foreground4. For administrator rights, MITRE notes that apps very rarely need administrator rights and advises developers not to use this level of access5.

Does the installed app stay visible?

Not necessarily. MITRE explains that mobile systems have interfaces for hiding items such as an app's icon, and that attackers misuse them6. The page on input capture asks users to be wary of dangerous permissions, such as access to accessibility7. Other attackers exploit system flaws to obtain higher rights8.

Is physical access to the device needed to infect it?

In the documented case of BusyGasper, yes: this spyware infected its victims through physical access to the device9.

1Inside the attacker's head1 min

The attacker has an obstacle: the device is often configured to accept only the authorized store2. They need a credible pretext, and the sources give one: the name and appearance of a well-known app4. In the Cerberus case, it is a fake Adobe Flash Player installer3.

Once the app is in place, its first goal is to obtain rights. Cerberus can inject inputs to grant itself additional permissions without user interaction and to prevent the app from being removed3. Collection and discretion come next: the attacker wants to read SMS messages, obtain contacts and the list of apps, then display fake screens on top of the apps the attacker has chosen3.

The sources also describe attackers who target the system itself. Some exploit operating system flaws to move from a limited level of access to superuser (root) rights8. MITRE cites Pegasus for Android, which tries to exploit known Android flaws, and Pegasus for iOS, which exploits iOS flaws8.

2What you see on screen1 min

The victim first sees the page or message that invites them to install software. The sources in the file do not describe the device's installation warning, so that step is not detailed here.

After installation, signs are rare, by design. MITRE explains that mobile systems offer interfaces for hiding items, such as an app's icon, and that these interfaces have legitimate uses that attackers misuse6. Cerberus hides its icon from the app drawer after its first launch3. BusyGasper lowers the screen brightness to the minimum and mutes the sound when it is active9.

The most visible sign is a fake input prompt. MITRE explains that malicious apps imitate system interface elements to ask for sensitive information, and that the small screen of a mobile device makes it harder to check the context4. They can also send fake notifications that open a prompt when touched4. Finally, a prompt can appear on top of a legitimate app4.

3Under the hoodIT teams1 min

The sources first describe overlay and accessibility, then persistence.

  • Overlay: the app draws a window on top of another one. It must hold the SYSTEM_ALERT_WINDOW permission, which MITRE says is granted automatically, at least under some conditions, to apps installed from Google Play4. Android 10 restricts launching an activity on top of another app4. Android 12 adds the HIDE_OVERLAY_WINDOWS permission, which makes it possible to hide these windows7.
  • Accessibility: a misuse makes it possible to know which app is in the foreground4. MITRE also points to apps that record keystrokes or capture information about screen gestures7.
  • Persistence: Cerberus disables Google Play Protect to avoid being discovered and removed later3. It can update its code on command3.

MITRE also specifies that app sandboxing limits access to another app's data, except in three cases: unprotected external storage, internal storage with weak permissions, or obtaining root rights10.

4Case filesReal cases1 min

Cerberus, a banking trojan for rent

Cerberus is an Android banking trojan whose use is rented out on underground forums3. Its authors claim to have used it privately for two years before offering it for rent3. The references of the MITRE page include a ThreatFabric report from August 2019 and an article dated 16 August 2019 on fake Adobe Flash Player installers3. The software could read SMS messages, obtain contacts and the list of apps, generate fake notifications and launch overlay attacks against the apps chosen by the attacker3.

BusyGasper, spyware (since May 2016)

BusyGasper is Android spyware in use since May 20169. Fewer than ten victims are known, all apparently in Russia, and all infected through physical access to the device9. It can record sound and the camera, copy photos and browser history, and read SMS messages and data from WhatsApp, Viber and Facebook9. The page's reference is an article by Alexey Firsh dated 29 August 20189.

5What you do1 min
  • Install only from the device's official store. An invitation to download a file or an "installer" from a website is suspect, even for well-known software3.
  • Refuse the accessibility, keyboard or administrator rights that an app requests without a clear reason. MITRE advises users to be wary of dangerous or intrusive permissions, such as registering a keyboard or accessing accessibility7.
  • Keep your phone locked and within reach: one documented case starts with physical access9.
  • Update the system: some protections, such as the Android 10 and Android 12 restrictions, depend on the version47.
  • On a managed device, the company can limit the permitted accessibility services through an explicit list, using a device management tool (EMM or MDM)7.
6Pitfalls1 min

The official store is not a complete guarantee2. A malicious app can also hide its icon, so the absence of a suspicious icon proves nothing6. MITRE writes that this type of technique cannot easily be countered by preventive controls, since it abuses system features6.

A security setting that changes without your action is a signal: Cerberus disables Google Play Protect3. In that case, or if an unknown app asks for broad rights, contact support.

Fact sheet

Identifier
CP-093
Wing
1. Attacks and techniques
Brain skill
Securing Devices & Mobile (secure_devices)
Brain reflex
cr-071
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
10 sources checked on 3 November 2026
Sources10 sources
  1. MITRE ATT&CK, “Masquerade as Legitimate Application, Technique T1444 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1444/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Deliver Malicious App via Authorized App Store, Technique T1475 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1475/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Cerberus, Software S0480 | MITRE ATT&CK®”. https://attack.mitre.org/software/S0480/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Input Capture: GUI Input Capture, Sub-technique T1417.002 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1417/002/ (accessed 3 November 2026)
  5. MITRE ATT&CK, “Abuse Elevation Control Mechanism, Technique T1626 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1626/ (accessed 3 November 2026)
  6. MITRE ATT&CK, “Hide Artifacts, Technique T1628 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1628/ (accessed 3 November 2026)
  7. MITRE ATT&CK, “Input Capture, Technique T1417 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1417/ (accessed 3 November 2026)
  8. MITRE ATT&CK, “Exploitation for Privilege Escalation, Technique T1404 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1404/ (accessed 3 November 2026)
  9. MITRE ATT&CK, “BusyGasper, Software S0655 | MITRE ATT&CK®”. https://attack.mitre.org/software/S0655/ (accessed 3 November 2026)
  10. MITRE ATT&CK, “Stored Application Data, Technique T1409 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1409/ (accessed 3 November 2026)

Cite this article

Brain, “Mobile app sideloading”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/mobile-app-sideloading/

BibTeX 
@misc{brain_cp093_en_2026,
  author = {Brain},
  title = {Mobile app sideloading},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/mobile-app-sideloading/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence