# T1437.001 Web Protocols > As of 2026-10-10, T1437.001 (Web Protocols) appears in 12 tracked threats, first reported 2026-02-24 and most recently 2026-10-09; it most often appears alongside T1516 (Input Injection). - **Tracked threats:** 12 (10 high, 2 medium) - **First seen:** 2026-02-24 - **Last seen:** 2026-10-09 - **Detection rules:** 62 (counts only; Blue tier and above) ## Key facts - **ID:** T1437.001 - **Framework:** MITRE ATT&CK - **Tactics:** Command and Control (Mobile) - **Matrix:** Mobile - **Parent:** T1437 - **Data as of:** 2026-10-10 - **MITRE:** https://attack.mitre.org/techniques/T1437/001/ ## Activity timeline T1437.001 first appeared in tracked threats on 2026-02-24 and was most recently reported on 2026-10-09. The busiest month was 2026-09 with 4 reports, and 12 of the 12 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1437.001 Web Protocols is catalogued by MITRE ATT&CK under the Command and Control (Mobile) tactic in the Mobile matrix, as a sub-technique of [T1437 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1437). Threadlinqs maps 12 of 2756 tracked threats (0.4%) to it; by severity that is 10 high, 2 medium. Threats that use T1437.001 most often also use [T1516 Input Injection](https://intel.threadlinqs.com/technique/T1516) (7 threats), [T1636.004 SMS Messages](https://intel.threadlinqs.com/technique/T1636.004) (7 threats), [T1417.001 Keylogging](https://intel.threadlinqs.com/technique/T1417.001) (6 threats), [T1418 Software Discovery](https://intel.threadlinqs.com/technique/T1418) (6 threats), [T1426 System Information Discovery](https://intel.threadlinqs.com/technique/T1426) (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. ## Tracked threats 12 tracked threats use T1437.001. - [Novinarya: Android stealer hiding its live C2 in a basalam.com shop profile bio](https://intel.threadlinqs.com/threat/TL-2026-3128) — high — 2026-10-09 - [Malicious PDF Reader on Google Play (10,000+ installs) Delivers Anatsa (TeaBot) Banking Trojan](https://intel.threadlinqs.com/threat/TL-2026-3099) — high — 2026-10-09 - [Midnight Mimosa: Low-cost MediaTek Android phones ship with firmware-level ad-fraud and residential proxy…](https://intel.threadlinqs.com/threat/TL-2026-3066) — high — 2026-10-09 - [GitHub Security Lab AI Agent Uncovers 24 Android App Vulnerabilities, Including OsmAnd Location-Tracking…](https://intel.threadlinqs.com/threat/TL-2026-2744) — medium — 2026-09-28 - [RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritization](https://intel.threadlinqs.com/threat/TL-2026-2743) — high — 2026-09-28 - [StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTok](https://intel.threadlinqs.com/threat/TL-2026-2312) — high — 2026-09-03 - [Chinese-Speaking Threat Actors Deploy PanDa Android RAT Against Mexican Banking Users via Meta Ads…](https://intel.threadlinqs.com/threat/TL-2026-2279) — high — 2026-09-01 - [Banking Trojans: Manic, Grandoreiro, and ToxicPanda 2.0 in the Spotlight](https://intel.threadlinqs.com/threat/TL-2026-2118) — high — 2026-08-22 - [Turkish Banking & Government-Portal Fraud Ecosystem: 8,400+ Phishing Domains, 6,700+ e-Devlet Lookalikes…](https://intel.threadlinqs.com/threat/TL-2026-1313) — high — 2026-07-14 - [Android.MagicAd Trojan Floods Devices with Ads via Xiaomi GetApps, Samsung Galaxy Store, and Preinstalled…](https://intel.threadlinqs.com/threat/TL-2026-0737) — medium — 2026-06-09 - [ResidentBat — Belarusian KGB Android Spyware at Internet Scale (ADB Sideloading, Custom HTTPS C2, Journalist…](https://intel.threadlinqs.com/threat/TL-2026-0143) — high — 2026-02-25 - [SURXRAT Android RAT — LLM Module Downloads from Hugging Face, MaaS via Telegram, ArsinkRAT Evolution](https://intel.threadlinqs.com/threat/TL-2026-0142) — high — 2026-02-24 ## Detection coverage Threadlinqs maintains 62 detection rules mapped to T1437.001 (SPL 21, KQL 22, Sigma 19). Rule content is available to Blue tier accounts and above; this page shows counts only. 62 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1437 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1437) — 35 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1437.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)