Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1636.004: SMS Messages

Adversaries may utilize standard operating system APIs to gather SMS messages. On Android, this can be accomplished using the SMS Content Provider. iOS provides no standard API to access SMS messages.

If the device has been jailbroken or rooted, an adversary may be able to access SMS Messages without the user’s knowledge or approval.

MobileT1636.004Sub-techniqueObject v1.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

SMS message access on mobile devices matters because SMS can contain sensitive personal, business, and authentication information. In ATT&CK, this sub-technique covers adversaries using mobile OS capabilities to gather SMS messages: Android can expose SMS through the SMS Content Provider, while iOS has no standard SMS access API unless the device is jailbroken or otherwise compromised.

Executive priority

Treat this as a mobile data-protection and identity-risk issue, especially where SMS is used for account recovery, notifications, or multi-factor authentication. Leaders should ask whether managed mobile devices are monitored for risky app permissions, rooting or jailbreaking, and unauthorized apps, and whether user guidance is documented as compliance evidence. The relationship history shows this behavior is mapped to multiple mobile malware families and campaigns in ATT&CK, so it should be considered in mobile threat modeling even though the supplied object does not provide active-exploitation claims.

Technical view

For SOC, detection engineering, and IR teams, validate coverage on Android and iOS separately. On Android, focus on apps requesting or using SMS-related permissions and access to SMS-backed data stores. On iOS, standard app telemetry is unlikely to show normal SMS API use because MITRE states no standard API exists; investigation should emphasize jailbreak/root indicators and suspicious mobile security alerts. Because ATT&CK provides no official detection text for this technique, teams should use the related DET0686 detection strategy as a mapping point but confirm what telemetry and logic are actually available in their environment.

Likely telemetry

  • Mobile device management or unified endpoint management inventory for Android and iOS devices
  • Installed mobile application inventory and application provenance
  • Android application manifest and permission grant data related to SMS access
  • Mobile threat defense or endpoint telemetry for suspicious app behavior
  • Rooting and jailbreaking status indicators

Detection direction

  • Baseline which approved Android applications legitimately require SMS permissions, then alert or review unusual, newly installed, or unapproved apps requesting those permissions.
  • Separate Android and iOS detection assumptions: Android may expose SMS through permission-backed mechanisms, while iOS SMS access should raise concern primarily in the context of jailbreak or deeper device compromise.
  • Tune for false positives from legitimate messaging, device-management, authentication, or carrier-related applications that may have valid SMS-related functions.
  • Correlate SMS access concern with parent Protected User Data behavior, risky permission requests, app sideloading or untrusted provenance, and root/jailbreak indicators.
  • Document detection gaps explicitly, since the ATT&CK object does not include official detection guidance.

Mitigation priorities

  • Prioritize user guidance, as mapped by MITRE mitigation M1011: train users to avoid granting unnecessary permissions and to report unexpected SMS permission prompts or suspicious apps.
  • Restrict mobile app installation sources and maintain an approved application baseline where device management supports it.
  • Review whether SMS is used for authentication or account recovery and account for the risk that mobile malware may capture SMS content on affected devices.
  • Enforce mobile device compliance checks for rooted or jailbroken devices before granting access to business resources.
  • Use mobile security controls and IR playbooks to support investigation and containment when SMS access by an untrusted app is suspected.
Analyst notes and limits

This object is a mobile ATT&CK sub-technique under Protected User Data and supersedes the revoked Capture SMS Messages technique relationship. The supplied relationships map it to several campaigns, groups, and software entries, including Android and iOS examples, but those relationships should be used for context and prioritization rather than as evidence of current activity in any specific environment.

ATT&CK provides no official detection text and no tactics for this object in the supplied fields. Detection feasibility depends heavily on mobile management, mobile threat defense, OS version, device ownership model, and whether devices are rooted or jailbroken. Local telemetry is required to determine actual coverage.

Official MITRE ATT&CK definition

SMS Messages

Adversaries may utilize standard operating system APIs to gather SMS messages. On Android, this can be accomplished using the SMS Content Provider. iOS provides no standard API to access SMS messages.

If the device has been jailbroken or rooted, an adversary may be able to access SMS Messages without the user’s knowledge or approval.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
Domain ID Name Relationship / procedure
Mobile T1412 Capture SMS Messages Capture SMS Messages revoked by this object.
Mobile T1636 Protected User Data This object subtechnique of Protected User Data.
Associated objects

Groups, software, and campaigns

Group Mobile

G0112: Windshift

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.[1][2][3]

Malware Mobile

S0418: ViceLeaker

ViceLeaker is a spyware framework, capable of extensive surveillance and data exfiltration operations, primarily targeting devices belonging to Israeli citizens.[1][2]

Android
Malware Mobile

S0329: Tangelo

Tangelo is iOS malware that is believed to be from the same developers as the Stealth Mango Android malware. It is not a mobile application, but rather a Debian package that can only run on jailbroken iOS devices. [1]

iOS
Malware Mobile

S0544: HenBox

HenBox is Android malware that attempts to only execute on Xiaomi devices running the MIUI operating system. HenBox has primarily been used to target Uyghurs, a minority Turkic ethnic group.[1]

Android
Malware Mobile

S0309: Adups

Adups is software that was pre-installed onto Android devices, including those made by BLU Products. The software was reportedly designed to help a Chinese phone manufacturer monitor user behavior, transferring sensitive data to a Chinese server. [1] [2]

Malware Mobile

S0432: Bread

Bread was a large-scale billing fraud malware family known for employing many different cloaking and obfuscation techniques in an attempt to continuously evade Google Play Store’s malware detection. 1,700 unique Bread apps were detected and removed from the Google Play Store before being downloaded by users.[1]

Android
Malware Mobile

S0423: Ginp

Ginp is an Android banking trojan that has been used to target Spanish banks. Some of the code was taken directly from Anubis.[1]

Android
Malware Mobile

S0301: Dendroid

Dendroid is an Android remote access tool (RAT) primarily targeting Western countries. The RAT was available for purchase for $300 and came bundled with a utility to inject the RAT into legitimate applications.[1]

Android
Malware Mobile

S1062: S.O.V.A.

S.O.V.A. is an Android banking trojan that was first identified in August 2021 and has subsequently been found in a variety of applications, including banking, cryptocurrency wallet/exchange, and shopping apps. S.O.V.A., which is Russian for "owl", contains features not commonly found in Android malware, such as session cookie theft.[1][2]

Android
Campaign Mobile

C0016: Operation Dust Storm

Operation Dust Storm was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the Operation Dust Storm threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.[1]

Operation Dust Storm threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.[1]

Relationship explorer

All related ATT&CK context

uses · Malware S0418: ViceLeaker Mobile uses · Malware S0329: Tangelo Mobile uses · Malware S1092: Escobar Mobile uses · Campaign C0033: C0033 Mobile uses · Malware S0544: HenBox Mobile uses · Malware S0309: Adups Mobile uses · Malware S0432: Bread Mobile uses · Malware S0423: Ginp Mobile uses · Malware S0295: RCSAndroid Mobile uses · Malware S0550: DoubleAgent Mobile uses · Malware S0301: Dendroid Mobile uses · Malware S1062: S.O.V.A. Mobile uses · Malware S0313: RuMMS Mobile uses · Malware S1126: Phenakite Mobile uses · Malware S0421: GolfSpy Mobile revoked by · Technique T1412: Capture SMS Messages Mobile uses · Malware S0536: GPlayed Mobile uses · Malware S0478: EventBot Mobile uses · Malware S0505: Desert Scorpion Mobile uses · Malware S0424: Triada Mobile uses · Malware S9005: DocSwap Mobile uses · Malware S1055: SharkBot Mobile uses · Malware S0427: TrickMo Mobile uses · Malware S0406: Gustuff Mobile
Mitigations

Mitigation direction

Mitigation Mobile

M1011: User Guidance

Describes any guidance or training given to users to set particular configuration settings or avoid specific potentially risky behaviors.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
d3e8ef12bb4b3f46...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.1 Current bundle d3e8ef12bb4b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    NIST Mobile Threat Catalogue APP-13
    Open source URL
  2. [2]
    mitre-attack T1636.004
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use