Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1422.002: Wi-Fi Discovery

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of Discovery or Credential Access activity to support both ongoing and future campaigns.

MobileT1422.002Sub-techniqueObject v1.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Wi-Fi Discovery is a mobile behavior where a compromised Android or iOS device is used to look for saved or nearby Wi-Fi network information, including network names and potentially passwords. For leaders, the risk is not just the phone: Wi-Fi details can help an adversary understand office, home, travel, or operational environments and may support later discovery or credential access activity.

Executive priority

Prioritize this as part of mobile security, identity, and incident response readiness where mobile devices connect to corporate, executive, regulated, or operational networks. The ATT&CK relationships show this behavior appears across multiple Android and iOS mobile malware entries, so executives should ask whether the organization can inventory mobile OS posture, restrict risky app access, preserve mobile evidence during incidents, and demonstrate that Wi-Fi credentials are not an unmanaged path into sensitive environments.

Technical view

This is a sub-technique of System Network Configuration Discovery for Android and iOS. MITRE does not provide technique-specific detection text, but a related detection strategy, DET0709 Detection of Wi-Fi Discovery, is linked. SOC and IR teams should validate whether mobile telemetry can show apps or processes attempting to access Wi-Fi configuration, saved network identifiers, connection metadata, or credential-related stores, and whether that activity can be correlated with suspicious app behavior or known mobile malware investigations. Because tactics are not specified in the object, map detections locally to discovery and credential-access use cases based on observed evidence rather than assuming intent.

Likely telemetry

  • Mobile device management or enterprise mobility management inventory for Android and iOS devices
  • Mobile OS version and patch-level data
  • Mobile app inventory, installation source, and permission posture
  • Mobile threat defense or endpoint telemetry for suspicious app behavior
  • Wi-Fi configuration and connection metadata where legally and technically available

Detection direction

  • Review DET0709, the linked detection strategy, and determine whether current mobile telemetry can observe Wi-Fi discovery attempts on Android and iOS.
  • Tune for suspicious access to Wi-Fi network information by apps that do not have a clear business need, especially when paired with spyware, banking trojan, or surveillanceware-like behavior identified in investigations.
  • Correlate mobile Wi-Fi discovery indicators with app installation source, unusual permissions, OS version, and other system network configuration discovery evidence.
  • Account for privacy and platform visibility limits: iOS and Android may restrict what defenders can collect, and BYOD programs may further limit monitoring.
  • Avoid treating all Wi-Fi metadata access as malicious; legitimate system services and enterprise network tools may generate benign activity.

Mitigation priorities

  • Maintain recent Android and iOS versions, aligning with MITRE mitigation M1006 Use Recent OS Version.
  • Use mobile device management controls to enforce OS update posture where appropriate.
  • Reduce exposure from untrusted or unnecessary mobile applications through approved app controls and user education consistent with the organization’s mobile policy.
  • Protect corporate Wi-Fi credentials with lifecycle management, segmentation, and rapid rotation procedures when mobile compromise is suspected.
  • Include mobile device evidence handling in incident response playbooks so Wi-Fi credential exposure can be assessed during containment.
Analyst notes and limits

The relationship set links this technique to multiple mobile malware software objects, including Pegasus for Android, RedDrop, Monokle, Corona Updates, TrickMo, INSOMNIA, TianySpy, Hornbill, BOULDSPY, LightSpy, DocSwap, and VajraSpy. That supports treating Wi-Fi Discovery as a recurring mobile malware capability, but it does not by itself establish current exposure or active exploitation in any environment.

MITRE provides no official detection text and no tactics are specified in the supplied object fields. Practical coverage depends on local mobile management architecture, privacy constraints, platform restrictions, app telemetry, and incident response access to devices. The supplied fields support Android and iOS only for this technique.

Official MITRE ATT&CK definition

Wi-Fi Discovery

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of Discovery or Credential Access activity to support both ongoing and future campaigns.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Mobile T1422 System Network Configuration Discovery This object subtechnique of System Network Configuration Discovery.
Associated objects

Groups, software, and campaigns

Malware Mobile

S1185: LightSpy

First observed in 2018, LightSpy is a modular malware family that initially targeted iOS devices in Southern Asia before expanding to Android and macOS platforms. It consists of a downloader, a main executable that manages network communications, and functionality-specific modules, typically implemented as `.dylib` files (iOS, macOS) or `.apk` files (Android). LightSpy can collect VoIP call recordings, SMS messages, and credential stores, which are then exfiltrated to a command and control (C2) server.[1]

AndroidWindowsiOS
Malware Mobile

S1079: BOULDSPY

BOULDSPY is an Android malware, detected in early 2023, with surveillance and remote-control capabilities. Analysis of exfiltrated C2 data suggests that BOULDSPY primarily targeted minority groups in Iran.[1]

Android
Malware Mobile

S0427: TrickMo

TrickMo a 2FA bypass mobile banking trojan, most likely being distributed by TrickBot. TrickMo has been primarily targeting users located in Germany.[1]

TrickMo is designed to steal transaction authorization numbers (TANs), which are typically used as one-time passwords.[1]

Android
Malware Mobile

S9005: DocSwap

DocSwap is an Android malware first identified in 2025, and attributed to Kimsuky. DocSwap’s name is a combination of its Korean name “문서열람 인증 앱” (Document Viewing Authentication App) and a phishing page masquerading as CoinSwap at the C2 address. Based on DocSwap’s name and Korean-language strings, DocSwap potentially targets mobile device users in South Korea. Several variants of DocSwap exist; one of the latest samples indicates that the adversary added a native decryption function that decrypts an internal APK.[1][2]

Android
Malware Mobile

S9006: VajraSpy

VajraSpy is Android malware distributed via trojanized messaging and news applications. It has been used to target individuals in Pakistan and India since at least 2021 and has been delivered through the Google Play Store, malicious domains, and other uncontrolled distribution channels. VajraSpy is attributed with high confidence to Patchwork which has used the malware to conduct targeted espionage, primarily against devices in Pakistan.[1][2][3]

Android
Malware Mobile

S0425: Corona Updates

Corona Updates is Android spyware that took advantage of the Coronavirus pandemic. The campaign distributing this spyware is tracked as Project Spy. Multiple variants of this spyware have been discovered to have been hosted on the Google Play Store.[1]

Android
Malware Mobile

S0407: Monokle

Monokle is targeted, sophisticated mobile surveillanceware. It is developed for Android, but there are some code artifacts that suggests an iOS version may be in development.[1]

Android
Malware Mobile

S1056: TianySpy

TianySpy is a mobile malware primarily spread by SMS phishing between September 30 and October 12, 2021. TianySpy is believed to have targeted credentials associated with membership websites of major Japanese telecommunication services.[1]

AndroidiOS
Relationship explorer

All related ATT&CK context

uses · Malware S1185: LightSpy Mobile uses · Malware S1079: BOULDSPY Mobile uses · Malware S0427: TrickMo Mobile uses · Malware S9005: DocSwap Mobile detects · Detection Strategy DET0709: Detection of Wi-Fi Discovery Mobile uses · Malware S0463: INSOMNIA Mobile subtechnique of · Technique T1422: System Network Configuration Discovery Mobile uses · Malware S9006: VajraSpy Mobile mitigates · Mitigation M1006: Use Recent OS Version Mobile uses · Malware S0316: Pegasus for Android Mobile uses · Malware S0425: Corona Updates Mobile uses · Malware S0407: Monokle Mobile uses · Malware S0326: RedDrop Mobile uses · Malware S1077: Hornbill Mobile uses · Malware S1056: TianySpy Mobile
Mitigations

Mitigation direction

Mitigation Mobile

M1006: Use Recent OS Version

New mobile operating system versions bring not only patches against discovered vulnerabilities but also often bring security architecture improvements that provide resilience against potential vulnerabilities or weaknesses that have not yet been discovered. They may also bring improvements that block use of observed adversary techniques.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
d000d12b092fe546...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.0 Current bundle d000d12b092f…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    mitre-attack T1422.002
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use