Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1616: Call Control

Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or forwarding calls from the device owner, or C2 communication.

Several permissions may be used to programmatically control phone calls, including:

* `ANSWER_PHONE_CALLS` - Allows the application to answer incoming phone calls[1] * `CALL_PHONE` - Allows the application to initiate a phone call without going through the Dialer interface[1] * `PROCESS_OUTGOING_CALLS` - Allows the application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether[1] * `MANAGE_OWN_CALLS` - Allows a calling application which manages its own calls through the self-managed `ConnectionService` APIs[1] * `BIND_TELECOM_CONNECTION_SERVICE` - Required permission when using a `ConnectionService`[1] * `WRITE_CALL_LOG` - Allows an application to write to the device call log, potentially to hide malicious phone calls[1]

When granted some of these permissions, an application can make a phone call without opening the dialer first. However, if an application desires to simply redirect the user to the dialer with a phone number filled in, it can launch an Intent using `Intent.ACTION_DIAL`, which requires no specific permissions. This then requires the user to explicitly initiate the call or use some form of Input Injection to programmatically initiate it.

MobileT1616TechniqueObject v1.2 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Call Control matters because a malicious Android app with sensitive phone permissions may answer, place, redirect, block, or obscure calls without the user’s authorization. For leaders, the business issue is not just mobile malware: it can affect fraud workflows, banking or help-desk verification calls, executive privacy, incident communications, and employee trust in managed devices.

Executive priority

Prioritize this where Android devices are used for privileged employees, customer support, finance, field operations, or any process that depends on voice calls for authentication, escalation, or business continuity. The ATT&CK relationships show this behavior is used by multiple Android malware and spyware families, including banking trojans and surveillanceware, so mobile permission governance and user guidance should be part of identity, fraud, SOC, and incident response readiness discussions.

Technical view

SOC and mobile security teams should validate whether they can identify Android applications requesting or using call-control-related permissions: ANSWER_PHONE_CALLS, CALL_PHONE, PROCESS_OUTGOING_CALLS, MANAGE_OWN_CALLS, BIND_TELECOM_CONNECTION_SERVICE, and WRITE_CALL_LOG. Review whether telemetry can connect app identity, granted permissions, call-log changes, and unexpected call initiation, forwarding, blocking, or redirection. ATT&CK lists a detection strategy relationship, DET0703, but the object itself provides no official detection text, so local detection content must be validated against device-management, mobile threat defense, and forensic data actually available.

Likely telemetry

  • Android application manifest permissions and runtime permission grants
  • Installed application inventory and package metadata from managed Android devices
  • Call logs, including unusual writes or missing/altered entries where available
  • Telecom/phone service events such as initiated, answered, redirected, aborted, or forwarded calls where available
  • Use of dialer intents such as ACTION_DIAL when correlated with suspicious automation or input activity

Detection direction

  • Inventory apps with call-control permissions and baseline which business-approved apps genuinely require them.
  • Tune detections around combinations of risky permissions rather than a single permission alone, because legitimate dialer, communications, accessibility, or enterprise apps may need some of these capabilities.
  • Correlate permission grants with call-log anomalies, unexpected outbound calls, blocked inbound calls, or redirection behavior.
  • Treat WRITE_CALL_LOG as especially important when paired with call initiation or redirection permissions, because the ATT&CK description notes it may be used to hide malicious calls.
  • Use relationship context to inform threat hunting for Android banking trojans, spyware, and surveillanceware, but do not assume attribution from this behavior alone.

Mitigation priorities

  • Start with M1011 User Guidance: teach users to scrutinize phone, call-log, and telecom permission prompts and to report unexpected call behavior.
  • Define which Android apps are allowed to request call-control permissions and remove or investigate applications outside that approved use case.
  • For managed devices, validate that mobile device policy, app review, and compliance processes can surface high-risk phone permissions before and after installation.
  • Include call-control abuse in mobile incident response playbooks, especially for finance, executive, support, and other call-dependent workflows.
  • Use ATT&CK relationship context to ensure mobile malware risk is represented in banking-fraud, privacy, and surveillance threat scenarios.
Analyst notes and limits

The strongest decision value is permission and telemetry validation: can the organization prove which Android apps can control calls, and can responders reconstruct what happened if calls are placed, blocked, forwarded, or hidden? The broad set of related software families makes this a useful mobile threat-hunting behavior, but it should be treated as a capability indicator, not proof of a specific actor or campaign.

MITRE does not provide official detection text or tactics for this object in the supplied fields. The object is limited to Android. Practical coverage depends on local mobile management, endpoint/mobile threat telemetry, privacy constraints, and whether call logs or telecom events are collected. No claim of active exploitation or customer exposure is made from the supplied data.

Official MITRE ATT&CK definition

Call Control

Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or forwarding calls from the device owner, or C2 communication.

Several permissions may be used to programmatically control phone calls, including:

* `ANSWER_PHONE_CALLS` - Allows the application to answer incoming phone calls[1] * `CALL_PHONE` - Allows the application to initiate a phone call without going through the Dialer interface[1] * `PROCESS_OUTGOING_CALLS` - Allows the application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether[1] * `MANAGE_OWN_CALLS` - Allows a calling application which manages its own calls through the self-managed `ConnectionService` APIs[1] * `BIND_TELECOM_CONNECTION_SERVICE` - Required permission when using a `ConnectionService`[1] * `WRITE_CALL_LOG` - Allows an application to write to the device call log, potentially to hide malicious phone calls[1]

When granted some of these permissions, an application can make a phone call without opening the dialer first. However, if an application desires to simply redirect the user to the dialer with a phone number filled in, it can launch an Intent using `Intent.ACTION_DIAL`, which requires no specific permissions. This then requires the user to explicitly initiate the call or use some form of Input Injection to programmatically initiate it.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Malware Mobile

S1195: SpyC23

SpyC23 is a mobile malware that has been used by APT-C-23 since at least 2017. SpyC23 has been observed primarily targeting Android devices in the Middle East.[1]

There are multiple close variants of SpyC23, such as VAMP[2], GnatSpy[3], Desert Scorpion and FrozenCell, which add some additional functionality but are not significantly different from the original malware.

Android
Malware Mobile

S9004: Crocodilus

Crocodilus is an Android banking Trojan that was discovered in March 2025. Crocodilus targeted users worldwide, including Turkey, Poland, Argentina, Brazil, Spain, the United States, Indonesia and India. Crocodilus has been customized based on the target location. For example, Crocodilus mimicked major Turkish and Spanish banks for users in Turkey and Spain, while users in Poland saw Facebook advertisements that promoted Crocodilus to claim bonus points.[1][2]

Android
Malware Mobile

S1083: Chameleon

Chameleon is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, Chameleon has been observed targeting users in Australia and Poland by masquerading as official applications. A new variant of Chameleon has expanded its targets to include Android users in the United Kingdom and Italy.[1][2]

Android
Malware Mobile

S1069: TangleBot

TangleBot is SMS malware that was initially observed in September 2021, primarily targeting mobile users in the United States and Canada. TangleBot has used SMS text message lures about COVID-19 regulations and vaccines to trick mobile users into downloading the malware, similar to FluBot Android malware campaigns.[1]

Android
Malware Mobile

S1054: Drinik

Drinik is an evolving Android banking trojan that was observed targeting customers of around 27 banks in India in August 2021. Initially seen as an SMS stealer in 2016, Drinik resurfaced as a banking trojan with more advanced capabilities included in subsequent versions between September 2021 and August 2022.[1]

Android
Malware Mobile

S0655: BusyGasper

BusyGasper is Android spyware that has been in use since May 2016. There have been less than 10 victims, all who appear to be located in Russia, that were all infected via physical access to the device.[1]

Android
Malware Mobile

S0422: Anubis

Anubis is Android malware that was originally used for cyber espionage, and has been retooled as a banking trojan.[1]

Android
Malware Mobile

S0407: Monokle

Monokle is targeted, sophisticated mobile surveillanceware. It is developed for Android, but there are some code artifacts that suggests an iOS version may be in development.[1]

Android
Malware Mobile

S9005: DocSwap

DocSwap is an Android malware first identified in 2025, and attributed to Kimsuky. DocSwap’s name is a combination of its Korean name “문서열람 인증 앱” (Document Viewing Authentication App) and a phishing page masquerading as CoinSwap at the C2 address. Based on DocSwap’s name and Korean-language strings, DocSwap potentially targets mobile device users in South Korea. Several variants of DocSwap exist; one of the latest samples indicates that the adversary added a native decryption function that decrypts an internal APK.[1][2]

Android
Malware Mobile

S1094: BRATA

BRATA (Brazilian Remote Access Tool, Android), is an evolving Android malware strain, detected in late 2018 and again in late 2021. Originating in Brazil, BRATA was later also found in the UK, Poland, Italy, Spain, and USA, where it is believed to have targeted financial institutions such as banks. There are currently three known variants of BRATA.[1][2][3]

Android
Relationship explorer

All related ATT&CK context

uses · Malware S1195: SpyC23 Mobile uses · Malware S9004: Crocodilus Mobile uses · Malware S1083: Chameleon Mobile uses · Malware S1092: Escobar Mobile detects · Detection Strategy DET0703: Detection of Call Control Mobile uses · Malware S1069: TangleBot Mobile uses · Malware S1054: Drinik Mobile uses · Malware S0655: BusyGasper Mobile uses · Malware S0529: CarbonSteal Mobile uses · Malware S0422: Anubis Mobile uses · Malware S0407: Monokle Mobile uses · Malware S9005: DocSwap Mobile uses · Malware S1094: BRATA Mobile uses · Malware S1080: Fakecalls Mobile mitigates · Mitigation M1011: User Guidance Mobile uses · Malware S1214: Android/SpyAgent Mobile uses · Malware S1231: GodFather Mobile uses · Malware S0292: AndroRAT Mobile uses · Malware S9006: VajraSpy Mobile
Mitigations

Mitigation direction

Mitigation Mobile

M1011: User Guidance

Describes any guidance or training given to users to set particular configuration settings or avoid specific potentially risky behaviors.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
75fbb6e6d32900f4...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.2 Current bundle 75fbb6e6d329…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Android Permissions

    Google. (2021, August 11). Manifest.permission. Retrieved September 22, 2021.

    Open source URL
  2. [2]
    NIST Mobile Threat Catalogue APP-41
    Open source URL
  3. [3]
    NIST Mobile Threat Catalogue CEL-18
    Open source URL
  4. [4]
    NIST Mobile Threat Catalogue CEL-36
    Open source URL
  5. [5]
    NIST Mobile Threat Catalogue CEL-42
    Open source URL
  6. [6]
    mitre-attack T1616
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use