T1437.001 Web Protocols

Activity timeline

T1437.001 first appeared in tracked threats on 2026-02-24 and was most recently reported on 2026-10-09. The busiest month was 2026-09 with 4 reports, and 12 of the 12 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1437.001 Web Protocols is catalogued by MITRE ATT&CK under the Command and Control (Mobile) tactic in the Mobile matrix, as a sub-technique of T1437 Application Layer Protocol. Threadlinqs maps 12 of 2756 tracked threats (0.4%) to it; by severity that is 10 high, 2 medium.

Threats that use T1437.001 most often also use T1516 Input Injection (7 threats), T1636.004 SMS Messages (7 threats), T1417.001 Keylogging (6 threats), T1418 Software Discovery (6 threats), T1426 System Information Discovery (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

Tracked threats

12 tracked threats use T1437.001.

• Novinarya: Android stealer hiding its live C2 in a basalam.com shop profile biohigh2026-10-09
• Malicious PDF Reader on Google Play (10,000+ installs) Delivers Anatsa (TeaBot) Banking Trojanhigh2026-10-09
• Midnight Mimosa: Low-cost MediaTek Android phones ship with firmware-level ad-fraud and residential proxy…high2026-10-09
• GitHub Security Lab AI Agent Uncovers 24 Android App Vulnerabilities, Including OsmAnd Location-Tracking…medium2026-09-28
• RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritizationhigh2026-09-28
• StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTokhigh2026-09-03
• Chinese-Speaking Threat Actors Deploy PanDa Android RAT Against Mexican Banking Users via Meta Ads…high2026-09-01
• Banking Trojans: Manic, Grandoreiro, and ToxicPanda 2.0 in the Spotlighthigh2026-08-22
• Turkish Banking & Government-Portal Fraud Ecosystem: 8,400+ Phishing Domains, 6,700+ e-Devlet Lookalikes…high2026-07-14
• Android.MagicAd Trojan Floods Devices with Ads via Xiaomi GetApps, Samsung Galaxy Store, and Preinstalled…medium2026-06-09
• ResidentBat — Belarusian KGB Android Spyware at Internet Scale (ADB Sideloading, Custom HTTPS C2, Journalist…high2026-02-25
• SURXRAT Android RAT — LLM Module Downloads from Hugging Face, MaaS via Telegram, ArsinkRAT Evolutionhigh2026-02-24

Detection coverage

Threadlinqs maintains 62 detection rules mapped to T1437.001 (SPL 21, KQL 22, Sigma 19). Rule content is available to Blue tier accounts and above; this page shows counts only.

Parent technique

T1437 Application Layer Protocol — 35 tracked threats at the technique level.