So how does these application reach the end user simply through different distribution mechanism?
The simplest one is Appstore distribution and where the Trojans are uploaded to the absolute in large
number to take advantage of the download volume, the Trojan is disguised in a free tool which supposedly
will have legitimate application purposes.
Another approach is to use phishing enabled distribution.
It's a popular method for coercing users into installing malicious applications is another approach
is to use phishing, enable distributions.
A popular method for coercing users to install malicious applications is to send them links to HBK files
hosted on the attacker Web site.
Normally this happens over s.m as or email spam messages.
A third approach is to distribute via compromised website.
The dissemination of mobile malware may be facilitated through the compromise of a legitimate website
that is then used to host malicious applications.
Distribution VÍA Operating System Images is an alternative to App Store deployment in where the Trojan
application is included within the custom operating system images.
So on the US platform itself, natively, so on platforms that allow device manufacturers to load their
own or as version images at the point of distribution.
There is a risk that Trojan application may be included as part of the standard distribution.
Compromised.
So scalds.
So legitimate.
Legitimate applications can also be romanized by a malicious actor without the knowledge of the original
developers.
So an attacker might compromise source code, do a malicious change and then upload the application.
At the end of the day, the users will install such applications that supposedly will facilitate their
compromised source.
Could happen when legitimate applications are chosen eyes by malicious actors without the knowledge
of the original developer.
The source code is then changed compiled and the AP K is uploaded to many platforms.
While the distribution of Trovan applications is the most common form of deployment mechanisms for mobile
malware.
There are some circumstances where a malicious actor may develop exploits for typical software installed
on target devices and use them to install their payloads without user interaction.
So an attacker might exploit a vulnerability in an application to to be able to silently install a malware
on the mobile phone of the user.
Last but not least, it's the loss of physical control where most of the deployment mechanisms described
above and where most of the deployment mechanisms we just describe involve compromise that occurs while
the device is in the hands of the user.
However, there may be situations where a malicious actor seeks to leverage a period of time when the
device is not in the possession of the user.
Scenarios such as monitoring software installed by authorities during a border transit or a device left
unattended, for example, and on Ortel or in a public place.