Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1417.001: Keylogging

Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.

Some methods of keylogging include:

* Masquerading as a legitimate third-party keyboard to record user keystrokes.[1] On both Android and iOS, users must explicitly authorize the use of third-party keyboard apps. Users should be advised to use extreme caution before granting this authorization when it is requested. * Abusing accessibility features. On Android, adversaries may abuse accessibility features to record keystrokes by registering an `AccessibilityService` class, overriding the `onAccessibilityEvent` method, and listening for the `AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED` event type. The event object passed into the function will contain the data that the user typed. *Additional methods of keylogging may be possible if root access is available.

MobileT1417.001Sub-techniqueObject v1.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Mobile keylogging matters because it can capture credentials and sensitive business data at the moment users type them into banking, cloud, identity, messaging, or enterprise applications. In ATT&CK, this is a mobile Input Capture sub-technique for Android and iOS, with described paths including malicious or risky third-party keyboards, Android accessibility abuse, and additional possibilities on rooted devices.

Executive priority

Treat this as a mobile identity-risk and data-protection issue, not just a malware feature. Leaders should ask whether enterprise mobility policy can control third-party keyboards, accessibility-service abuse, and rooted devices, and whether SOC/IR teams receive enough mobile telemetry to investigate credential exposure. The large number of related Android banking malware and surveillanceware entries makes Android coverage especially important, while iOS risk remains relevant where third-party keyboards are permitted.

Technical view

For SOC, detection engineering, and IR teams, validate coverage for Android and iOS devices where users can authorize third-party keyboards. On Android, focus on apps registering AccessibilityService behavior and listening to text-change events such as TYPE_VIEW_TEXT_CHANGED. Because ATT&CK provides no official detection text for this object, use DET0661 as relationship context only and confirm what it actually requires in local tooling. Investigations should tie mobile app inventory, granted permissions, keyboard configuration, accessibility settings, and root/jailbreak state to credential-risk decisions.

Likely telemetry

  • Mobile device inventory for Android and iOS assets
  • Installed mobile application inventory and app source/context where available
  • Third-party keyboard installation and authorization state
  • Android accessibility service registrations and permission grants
  • Android accessibility text-change event related evidence where available

Detection direction

  • Validate whether mobile telemetry can show newly authorized third-party keyboards on Android and iOS, not only installed apps.
  • On Android, tune for unapproved applications granted accessibility capabilities, especially those capable of observing text changes.
  • Baseline legitimate keyboard, accessibility, parental-control, and employee-monitoring applications to reduce false positives while preserving investigation paths for risky use.
  • Prioritize detections on devices used for identity administration, finance, executive communications, banking, cryptocurrency, or other sensitive workflows when local business context supports it.
  • Include root or jailbreak status in triage because ATT&CK notes additional keylogging methods may be possible with root access.

Mitigation priorities

  • Use enterprise mobility management/mobile device management policy where available to control allowed mobile behavior, consistent with ATT&CK mitigation M1012 Enterprise Policy.
  • Define and enforce an approved list or risk-based review process for third-party keyboards and accessibility-dependent applications.
  • Provide user guidance, consistent with M1011, warning users to be extremely cautious before authorizing third-party keyboard apps.
  • Treat unexpected accessibility permissions, third-party keyboards, or rooted devices on business-access devices as credential-risk events requiring review.
  • Pair mobile controls with incident-response playbooks for credential reset, session review, and affected-app assessment when keylogging is suspected.
Analyst notes and limits

ATT&CK links this sub-technique to Input Capture and to multiple Android malware/software entries including banking trojans, spyware, and surveillanceware, plus the Windshift group relationship. Those relationships support prioritizing mobile credential-theft readiness, especially on Android, but they do not prove activity in any specific environment.

The supplied ATT&CK object does not specify tactics and does not provide official detection content. Detection details for DET0661 were not supplied beyond the relationship name. Local EMM/MDM, mobile threat defense, logging, and device configuration data are required to determine actual visibility and control coverage.

Official MITRE ATT&CK definition

Keylogging

Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.

Some methods of keylogging include:

* Masquerading as a legitimate third-party keyboard to record user keystrokes.[1] On both Android and iOS, users must explicitly authorize the use of third-party keyboard apps. Users should be advised to use extreme caution before granting this authorization when it is requested. * Abusing accessibility features. On Android, adversaries may abuse accessibility features to record keystrokes by registering an `AccessibilityService` class, overriding the `onAccessibilityEvent` method, and listening for the `AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED` event type. The event object passed into the function will contain the data that the user typed. *Additional methods of keylogging may be possible if root access is available.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Mobile T1417 Input Capture This object subtechnique of Input Capture.
Associated objects

Groups, software, and campaigns

Group Mobile

G0112: Windshift

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.[1][2][3]

Malware Mobile

S9005: DocSwap

DocSwap is an Android malware first identified in 2025, and attributed to Kimsuky. DocSwap’s name is a combination of its Korean name “문서열람 인증 앱” (Document Viewing Authentication App) and a phishing page masquerading as CoinSwap at the C2 address. Based on DocSwap’s name and Korean-language strings, DocSwap potentially targets mobile device users in South Korea. Several variants of DocSwap exist; one of the latest samples indicates that the adversary added a native decryption function that decrypts an internal APK.[1][2]

Android
Malware Mobile

S1055: SharkBot

SharkBot is a banking malware, first discovered in October 2021, that tries to initiate money transfers directly from compromised devices by abusing Accessibility Services.[1]

Android
Malware Mobile

S0407: Monokle

Monokle is targeted, sophisticated mobile surveillanceware. It is developed for Android, but there are some code artifacts that suggests an iOS version may be in development.[1]

Android
Malware Mobile

S0655: BusyGasper

BusyGasper is Android spyware that has been in use since May 2016. There have been less than 10 victims, all who appear to be located in Russia, that were all infected via physical access to the device.[1]

Android
Malware Mobile

S1094: BRATA

BRATA (Brazilian Remote Access Tool, Android), is an evolving Android malware strain, detected in late 2018 and again in late 2021. Originating in Brazil, BRATA was later also found in the UK, Poland, Italy, Spain, and USA, where it is believed to have targeted financial institutions such as banks. There are currently three known variants of BRATA.[1][2][3]

Android
Tool Mobile

S0408: FlexiSpy

FlexiSpy is sophisticated surveillanceware for iOS and Android. Publicly-available, comprehensive analysis has only been found for the Android version.[1][2]

FlexiSpy markets itself as a parental control and employee monitoring application.[3]

Android
Malware Mobile

S1062: S.O.V.A.

S.O.V.A. is an Android banking trojan that was first identified in August 2021 and has subsequently been found in a variety of applications, including banking, cryptocurrency wallet/exchange, and shopping apps. S.O.V.A., which is Russian for "owl", contains features not commonly found in Android malware, such as session cookie theft.[1][2]

Android
Malware Mobile

S1054: Drinik

Drinik is an evolving Android banking trojan that was observed targeting customers of around 27 banks in India in August 2021. Initially seen as an SMS stealer in 2016, Drinik resurfaced as a banking trojan with more advanced capabilities included in subsequent versions between September 2021 and August 2022.[1]

Android
Malware Mobile

S1083: Chameleon

Chameleon is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, Chameleon has been observed targeting users in Australia and Poland by masquerading as official applications. A new variant of Chameleon has expanded its targets to include Android users in the United Kingdom and Italy.[1][2]

Android
Malware Mobile

S1231: GodFather

GodFather is an Android banking malware that uses virtualization to mimic legitimate applications and abuses accessibility services and other permissions to evade detection and exfiltrate sensitive data. First identified in 2020, GodFather targets nearly 500 banking applications, cryptocurrency wallets, and exchanges worldwide; however, its virtualization-based attacks have primarily focused on several Turkish financial institutions. This capability enables threat actors to steal banking credentials and other sensitive account information. [1][2]

Android
Malware Mobile

S1079: BOULDSPY

BOULDSPY is an Android malware, detected in early 2023, with surveillance and remote-control capabilities. Analysis of exfiltrated C2 data suggests that BOULDSPY primarily targeted minority groups in Iran.[1]

Android
Relationship explorer

All related ATT&CK context

uses · Malware S9005: DocSwap Mobile uses · Malware S1055: SharkBot Mobile uses · Malware S0407: Monokle Mobile mitigates · Mitigation M1012: Enterprise Policy Mobile uses · Malware S0655: BusyGasper Mobile uses · Malware S1094: BRATA Mobile uses · Tool S0408: FlexiSpy Mobile uses · Malware S1062: S.O.V.A. Mobile uses · Malware S1054: Drinik Mobile uses · Malware S1083: Chameleon Mobile uses · Malware S0406: Gustuff Mobile uses · Malware S1231: GodFather Mobile uses · Group G0112: Windshift Mobile mitigates · Mitigation M1011: User Guidance Mobile uses · Malware S1079: BOULDSPY Mobile uses · Malware S0522: Exobot Mobile uses · Malware S0422: Anubis Mobile subtechnique of · Technique T1417: Input Capture Mobile uses · Malware S0478: EventBot Mobile detects · Detection Strategy DET0661: Detection of Keylogging Mobile uses · Malware S1092: Escobar Mobile uses · Malware S9004: Crocodilus Mobile uses · Malware S0480: Cerberus Mobile uses · Malware S9006: VajraSpy Mobile
Mitigations

Mitigation direction

Mitigation Mobile

M1012: Enterprise Policy

An enterprise mobility management (EMM), also known as mobile device management (MDM), system can be used to provision policies to mobile devices to control aspects of their allowed behavior.

Mitigation Mobile

M1011: User Guidance

Describes any guidance or training given to users to set particular configuration settings or avoid specific potentially risky behaviors.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
77244bb5469c6e41...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.1 Current bundle 77244bb5469c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Zeltser-Keyboard

    Lenny Zeltser. (2016, July 30). Security of Third-Party Keyboard Apps on Mobile Devices. Retrieved December 21, 2016.

    Open source URL
  2. [2]
    NIST Mobile Threat Catalogue AUT-13
    Open source URL
  3. [3]
    mitre-attack T1417.001
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use