{
  "type": "attack-pattern",
  "spec_version": "2.1",
  "id": "attack-pattern--f05fc151-aa62-47e3-ae57-2d1b23d64bf6",
  "created": "2022-03-30T20:06:22.194Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "revoked": false,
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T1628/001",
      "external_id": "T1628.001"
    },
    {
      "source_name": "Android 10 Limitations to Hiding App Icons",
      "description": "Android. (n.d.). Android 10 Release Notes: Limitations to hiding app icons. Retrieved March 30, 2022.",
      "url": "https://source.android.com/setup/start/android-10-release#limitations_to_hiding_app_icons"
    },
    {
      "source_name": "LauncherApps getActivityList",
      "description": "Android. (n.d.). LauncherApps: getActivityList. Retrieved March 30, 2022.",
      "url": "https://developer.android.com/reference/kotlin/android/content/pm/LauncherApps#getactivitylist"
    },
    {
      "source_name": "sunny-stolen-credentials",
      "description": "Lukáš Štefanko. (2017, February 22). Sunny with a chance of stolen credentials: Malicious weather app found on Google Play. Retrieved July 11, 2019.",
      "url": "https://www.welivesecurity.com/2017/02/22/sunny-chance-stolen-credentials-malicious-weather-app-found-google-play/"
    },
    {
      "source_name": "android-trojan-steals-paypal-2fa",
      "description": "Lukáš Štefanko. (2018, December 11). Android Trojan steals money from PayPal accounts even with 2FA on. Retrieved July 11, 2019.",
      "url": "https://www.welivesecurity.com/2018/12/11/android-trojan-steals-money-paypal-accounts-2fa/"
    },
    {
      "source_name": "bankbot-spybanker",
      "description": "NJCCIC. (2017, March 2). BankBot/Spy Banker. Retrieved September 12, 2024.",
      "url": "https://www.cyber.nj.gov/threat-landscape/malware/trojans/bankbot-spy-banker"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2025-10-24T17:49:35.410Z",
  "name": "Suppress Application Icon",
  "description": "A malicious application could suppress its icon from being displayed to the user in the application launcher. This hides the fact that it is installed, and can make it more difficult for the user to uninstall the application. Hiding the application's icon programmatically does not require any special permissions. \n\nThis behavior has been seen in the BankBot/Spy Banker family of malware.(Citation: android-trojan-steals-paypal-2fa)(Citation: sunny-stolen-credentials)(Citation: bankbot-spybanker) \n\nBeginning in Android 10, changes were introduced to inhibit malicious applications’ ability to hide their icon. If an app is a system app, requests no permissions, or does not have a launcher activity, the application’s icon will be fully hidden. Further, if the device is fully managed or the application is in a work profile, the icon will be fully hidden. Otherwise, a synthesized activity is shown, which is a launcher icon that represents the app’s details page in the system settings. If the user clicks the synthesized activity in the launcher, they are taken to the application’s details page in the system settings.(Citation: Android 10 Limitations to Hiding App Icons)(Citation: LauncherApps getActivityList)",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-mobile-attack",
      "phase_name": "defense-evasion"
    }
  ],
  "x_mitre_attack_spec_version": "3.2.0",
  "x_mitre_contributors": [
    "Emily Ratliff, IBM"
  ],
  "x_mitre_deprecated": false,
  "x_mitre_domains": [
    "mobile-attack"
  ],
  "x_mitre_is_subtechnique": true,
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_platforms": [
    "Android"
  ],
  "x_mitre_version": "1.1",
  "x_mitre_tactic_type": [
    "Post-Adversary Device Access"
  ]
}