Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1636.003: Contact List

Adversaries may utilize standard operating system APIs to gather contact list data. On Android, this can be accomplished using the Contacts Content Provider. On iOS, this can be accomplished using the `Contacts` framework.

If the device has been jailbroken or rooted, an adversary may be able to access the Contact List without the user’s knowledge or approval.

MobileT1636.003Sub-techniqueObject v1.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Contact List is a mobile ATT&CK sub-technique covering attempts by apps to collect a user’s address book through normal Android or iOS APIs, or without normal approval if the device is rooted or jailbroken. For leaders, the risk is not just privacy loss: contact data can expose executives, customers, partners, and internal relationships that may support follow-on targeting or surveillance.

Executive priority

Treat this as a mobile privacy and incident-readiness issue, especially for users with sensitive relationship data such as executives, government-facing teams, legal, HR, security, and critical operations personnel. The key governance question is whether the organization can show which mobile apps request or receive contacts access, whether users are guided to deny unnecessary access, and whether rooted or jailbroken devices are visible in mobile security processes.

Technical view

Validate coverage on Android and iOS for apps requesting or using contact-list access. On Android, review applications that declare or use access associated with the Contacts Content Provider. On iOS, review applications declaring or using the Contacts framework through required app metadata and user permission flows. Because official ATT&CK detection text is not provided, use the related DET0679 detection strategy as a mapping point but require local engineering to define the actual signals, thresholds, and response workflow. Pay special attention to rooted or jailbroken devices, where access may occur without normal user knowledge or approval.

Likely telemetry

  • Mobile app inventory from managed devices, including installed applications and versions
  • Android application manifest permissions related to contacts access
  • iOS application Info.plist entries related to Contacts framework access
  • Runtime permission grant or denial events where available
  • Mobile device management or mobile threat defense records for app permissions and privacy access

Detection direction

  • Inventory apps with contacts access and compare requested access to business need; many legitimate apps may request contacts, so context is required to reduce false positives.
  • Prioritize alerts where contacts access appears in apps with weak business justification, recently installed apps, or apps on high-risk user devices.
  • Correlate contact-list access with rooted or jailbroken status because ATT&CK notes that normal approval may be bypassed in that condition.
  • Use relationship context to inform threat hunting: multiple Android and iOS malware/software entries are mapped to this behavior, but do not infer local exposure without device evidence.
  • Document detection gaps explicitly because ATT&CK does not provide official detection logic for this object.

Mitigation priorities

  • Start with M1011 User Guidance: train users to deny contacts access unless it is clearly required for the app’s business purpose.
  • Provide specific guidance for high-risk mobile users on reviewing existing contacts permissions and avoiding risky permission grants.
  • Include rooted or jailbroken device guidance in mobile policy because ATT&CK notes these states can weaken normal permission approval expectations.
  • Use mobile app review and permission governance to support compliance evidence around sensitive personal or relationship data access.
Analyst notes and limits

This object is a sub-technique of T1636 Protected User Data and replaces the revoked T1432 Access Contact List. Relationship mappings show use by several mobile software entries and some threat activity references, which supports the behavior’s relevance for mobile surveillanceware, RATs, spyware, and banking malware analysis. The supplied object does not specify ATT&CK tactics.

Official ATT&CK detection guidance is not provided, and the related DET0679 detection strategy details are not included in the supplied fields. Practical detection depends on local MDM/UEM, mobile threat defense, OS logging, app inventory quality, and whether Android/iOS permission telemetry is available.

Official MITRE ATT&CK definition

Contact List

Adversaries may utilize standard operating system APIs to gather contact list data. On Android, this can be accomplished using the Contacts Content Provider. On iOS, this can be accomplished using the `Contacts` framework.

If the device has been jailbroken or rooted, an adversary may be able to access the Contact List without the user’s knowledge or approval.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
Domain ID Name Relationship / procedure
Mobile T1636 Protected User Data This object subtechnique of Protected User Data.
Mobile T1432 Access Contact List Access Contact List revoked by this object.
Associated objects

Groups, software, and campaigns

Group Mobile

G0112: Windshift

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.[1][2][3]

Malware Mobile

S0549: SilkBean

SilkBean is a piece of Android surveillanceware containing comprehensive remote access tool (RAT) functionality that has been used in targeting of the Uyghur ethnic group.[1]

Android
Malware Mobile

S1241: RatMilad

RatMilad is an Android remote access tool (RAT) with spyware functionality that has been used to target enterprise mobile devices in the Middle East since at least 2021. Variants of RatMilad have been disguised as VPN applications and a fake app named NumRent. Upon installation, RatMilad employs multiple Collection techniques to collect sensitive information before uploading the collected data to its command and control (C2) server. [1]

Android
Malware Mobile

S0485: Mandrake

Mandrake is a sophisticated Android espionage platform that has been active in the wild since at least 2016. Mandrake is very actively maintained, with sophisticated features and attacks that are executed with surgical precision.

Mandrake has gone undetected for several years by providing legitimate, ad-free applications with social media and real reviews to back the apps. The malware is only activated when the operators issue a specific command.[1]

Android
Malware Mobile

S0506: ViperRAT

ViperRAT is sophisticated surveillanceware that has been in operation since at least 2015 and was used to target the Israeli Defense Force.[1]

Android
Malware Mobile

S1185: LightSpy

First observed in 2018, LightSpy is a modular malware family that initially targeted iOS devices in Southern Asia before expanding to Android and macOS platforms. It consists of a downloader, a main executable that manages network communications, and functionality-specific modules, typically implemented as `.dylib` files (iOS, macOS) or `.apk` files (Android). LightSpy can collect VoIP call recordings, SMS messages, and credential stores, which are then exfiltrated to a command and control (C2) server.[1]

AndroidWindowsiOS
Malware Mobile

S1079: BOULDSPY

BOULDSPY is an Android malware, detected in early 2023, with surveillance and remote-control capabilities. Analysis of exfiltrated C2 data suggests that BOULDSPY primarily targeted minority groups in Iran.[1]

Android
Malware Mobile

S1243: DCHSpy

DCHSpy is an Android spyware likely used by MuddyWater. DCHSpy uses political decoys and masquerades as legitimate applications, such as VPNs and banking applications, to trick victims into downloading the malware. Once downloaded, DCHSpy collects information from the device and exfiltrates the data to the command and control (C2) server.[1]

Android
Malware Mobile

S0411: Rotexy

Rotexy is an Android banking malware that has evolved over several years. It was originally an SMS spyware Trojan first spotted in October 2014, and since then has evolved to contain more features, including ransomware functionality.[1]

Android
Malware Mobile

S1067: FluBot

FluBot is a multi-purpose mobile banking malware that was first observed in Spain in late 2020. It primarily spread through European countries using a variety of SMS phishing messages in multiple languages.[1][2] An international law enforcement operation of 11 countries eventually disrupted the spread of FluBot.[3]

Android
Malware Mobile

S1069: TangleBot

TangleBot is SMS malware that was initially observed in September 2021, primarily targeting mobile users in the United States and Canada. TangleBot has used SMS text message lures about COVID-19 regulations and vaccines to trick mobile users into downloading the malware, similar to FluBot Android malware campaigns.[1]

Android
Relationship explorer

All related ATT&CK context

uses · Malware S0549: SilkBean Mobile uses · Malware S1241: RatMilad Mobile uses · Malware S0485: Mandrake Mobile uses · Malware S1077: Hornbill Mobile uses · Malware S0506: ViperRAT Mobile uses · Malware S1185: LightSpy Mobile uses · Group G0112: Windshift Mobile uses · Malware S1079: BOULDSPY Mobile uses · Malware S0550: DoubleAgent Mobile uses · Malware S1243: DCHSpy Mobile uses · Malware S0411: Rotexy Mobile uses · Malware S1067: FluBot Mobile uses · Malware S1069: TangleBot Mobile uses · Malware S0536: GPlayed Mobile uses · Malware S0403: Riltok Mobile uses · Malware S0421: GolfSpy Mobile uses · Malware S0480: Cerberus Mobile uses · Malware S1095: AhRat Mobile uses · Malware S1128: HilalRAT Mobile uses · Malware S0539: Red Alert 2.0 Mobile uses · Malware S0507: eSurv Mobile uses · Malware S0405: Exodus Mobile uses · Malware S0305: SpyNote RAT Mobile uses · Malware S1080: Fakecalls Mobile
Mitigations

Mitigation direction

Mitigation Mobile

M1011: User Guidance

Describes any guidance or training given to users to set particular configuration settings or avoid specific potentially risky behaviors.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
e97a78dd41a16066...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.1 Current bundle e97a78dd41a1…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    NIST Mobile Threat Catalogue APP-13
    Open source URL
  2. [2]
    mitre-attack T1636.003
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use