T1417.001: Keylogging
Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.
Some methods of keylogging include:
* Masquerading as a legitimate third-party keyboard to record user keystrokes.[1] On both Android and iOS, users must explicitly authorize the use of third-party keyboard apps. Users should be advised to use extreme caution before granting this authorization when it is requested. * Abusing accessibility features. On Android, adversaries may abuse accessibility features to record keystrokes by registering an `AccessibilityService` class, overriding the `onAccessibilityEvent` method, and listening for the `AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED` event type. The event object passed into the function will contain the data that the user typed. *Additional methods of keylogging may be possible if root access is available.
Security context for executives and security teams
Mobile keylogging matters because it can capture credentials and sensitive business data at the moment users type them into banking, cloud, identity, messaging, or enterprise applications. In ATT&CK, this is a mobile Input Capture sub-technique for Android and iOS, with described paths including malicious or risky third-party keyboards, Android accessibility abuse, and additional possibilities on rooted devices.
Executive priority
Treat this as a mobile identity-risk and data-protection issue, not just a malware feature. Leaders should ask whether enterprise mobility policy can control third-party keyboards, accessibility-service abuse, and rooted devices, and whether SOC/IR teams receive enough mobile telemetry to investigate credential exposure. The large number of related Android banking malware and surveillanceware entries makes Android coverage especially important, while iOS risk remains relevant where third-party keyboards are permitted.
Technical view
For SOC, detection engineering, and IR teams, validate coverage for Android and iOS devices where users can authorize third-party keyboards. On Android, focus on apps registering AccessibilityService behavior and listening to text-change events such as TYPE_VIEW_TEXT_CHANGED. Because ATT&CK provides no official detection text for this object, use DET0661 as relationship context only and confirm what it actually requires in local tooling. Investigations should tie mobile app inventory, granted permissions, keyboard configuration, accessibility settings, and root/jailbreak state to credential-risk decisions.
Likely telemetry
- Mobile device inventory for Android and iOS assets
- Installed mobile application inventory and app source/context where available
- Third-party keyboard installation and authorization state
- Android accessibility service registrations and permission grants
- Android accessibility text-change event related evidence where available
Detection direction
- Validate whether mobile telemetry can show newly authorized third-party keyboards on Android and iOS, not only installed apps.
- On Android, tune for unapproved applications granted accessibility capabilities, especially those capable of observing text changes.
- Baseline legitimate keyboard, accessibility, parental-control, and employee-monitoring applications to reduce false positives while preserving investigation paths for risky use.
- Prioritize detections on devices used for identity administration, finance, executive communications, banking, cryptocurrency, or other sensitive workflows when local business context supports it.
- Include root or jailbreak status in triage because ATT&CK notes additional keylogging methods may be possible with root access.
Mitigation priorities
- Use enterprise mobility management/mobile device management policy where available to control allowed mobile behavior, consistent with ATT&CK mitigation M1012 Enterprise Policy.
- Define and enforce an approved list or risk-based review process for third-party keyboards and accessibility-dependent applications.
- Provide user guidance, consistent with M1011, warning users to be extremely cautious before authorizing third-party keyboard apps.
- Treat unexpected accessibility permissions, third-party keyboards, or rooted devices on business-access devices as credential-risk events requiring review.
- Pair mobile controls with incident-response playbooks for credential reset, session review, and affected-app assessment when keylogging is suspected.
Additional notes and limits
ATT&CK links this sub-technique to Input Capture and to multiple Android malware/software entries including banking trojans, spyware, and surveillanceware, plus the Windshift group relationship. Those relationships support prioritizing mobile credential-theft readiness, especially on Android, but they do not prove activity in any specific environment.
The supplied ATT&CK object does not specify tactics and does not provide official detection content. Detection details for DET0661 were not supplied beyond the relationship name. Local EMM/MDM, mobile threat defense, logging, and device configuration data are required to determine actual visibility and control coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Keylogging
Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.
Some methods of keylogging include:
* Masquerading as a legitimate third-party keyboard to record user keystrokes.[1] On both Android and iOS, users must explicitly authorize the use of third-party keyboard apps. Users should be advised to use extreme caution before granting this authorization when it is requested. * Abusing accessibility features. On Android, adversaries may abuse accessibility features to record keystrokes by registering an `AccessibilityService` class, overriding the `onAccessibilityEvent` method, and listening for the `AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED` event type. The event object passed into the function will contain the data that the user typed. *Additional methods of keylogging may be possible if root access is available.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Mobile | T1417 | Input Capture | This object subtechnique of Input Capture. |
Groups, software, and campaigns
G0112: Windshift
S9005: DocSwap
DocSwap is an Android malware first identified in 2025, and attributed to Kimsuky. DocSwap’s name is a combination of its Korean name “문서열람 인증 앱” (Document Viewing Authentication App) and a phishing page masquerading as CoinSwap at the C2 address. Based on DocSwap’s name and Korean-language strings, DocSwap potentially targets mobile device users in South Korea. Several variants of DocSwap exist; one of the latest samples indicates that the adversary added a native decryption function that decrypts an internal APK.[1][2]
S1055: SharkBot
S0407: Monokle
S0655: BusyGasper
BusyGasper is Android spyware that has been in use since May 2016. There have been less than 10 victims, all who appear to be located in Russia, that were all infected via physical access to the device.[1]
S1094: BRATA
BRATA (Brazilian Remote Access Tool, Android), is an evolving Android malware strain, detected in late 2018 and again in late 2021. Originating in Brazil, BRATA was later also found in the UK, Poland, Italy, Spain, and USA, where it is believed to have targeted financial institutions such as banks. There are currently three known variants of BRATA.[1][2][3]
S0408: FlexiSpy
S1062: S.O.V.A.
S.O.V.A. is an Android banking trojan that was first identified in August 2021 and has subsequently been found in a variety of applications, including banking, cryptocurrency wallet/exchange, and shopping apps. S.O.V.A., which is Russian for "owl", contains features not commonly found in Android malware, such as session cookie theft.[1][2]
S1054: Drinik
Drinik is an evolving Android banking trojan that was observed targeting customers of around 27 banks in India in August 2021. Initially seen as an SMS stealer in 2016, Drinik resurfaced as a banking trojan with more advanced capabilities included in subsequent versions between September 2021 and August 2022.[1]
S1083: Chameleon
Chameleon is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, Chameleon has been observed targeting users in Australia and Poland by masquerading as official applications. A new variant of Chameleon has expanded its targets to include Android users in the United Kingdom and Italy.[1][2]
S0406: Gustuff
S1231: GodFather
GodFather is an Android banking malware that uses virtualization to mimic legitimate applications and abuses accessibility services and other permissions to evade detection and exfiltrate sensitive data. First identified in 2020, GodFather targets nearly 500 banking applications, cryptocurrency wallets, and exchanges worldwide; however, its virtualization-based attacks have primarily focused on several Turkish financial institutions. This capability enables threat actors to steal banking credentials and other sensitive account information. [1][2]
S1079: BOULDSPY
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 77244bb5469c… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Zeltser-Keyboard
Lenny Zeltser. (2016, July 30). Security of Third-Party Keyboard Apps on Mobile Devices. Retrieved December 21, 2016.
Open source URL - [2]EnkiWhiteHat_KimsukyDOCSWAP_Dec2025
EnkiWhiteHat. (2025, December 16). Kimsuky Distributing Malicious Mobile App via QR Code. Retrieved January 8, 2026.
Open source URL - [3]S2W_DocSwap_Mar2025
Kim, H., S2W TALON. (2025, March 13). Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer. Retrieved January 12, 2026.
Open source URL - [4]nccgroup_sharkbot_0322
RIFT: Research and Intelligence Fusion Team. (2022, March 3). SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store. Retrieved January 18, 2023.
Open source URL - [5]Lookout-Monokle
Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
Open source URL - [6]Samsung Keyboards
Samsung. (2019, August 16). 3rd party keyboards must be whitelisted.. Retrieved November 17, 2024.
Open source URL - [7]SecureList BusyGasper
Alexey Firsh. (2018, August 29). BusyGasper – the unfriendly spy. Retrieved October 1, 2021.
Open source URL - [8]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [9]cleafy_brata_0122
Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
Open source URL - [10]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [11]FlexiSpy-Features
FlexiSpy. (n.d.). FlexiSpy Monitoring Features. Retrieved September 4, 2019.
Open source URL - [12]threatfabric_sova_0921
ThreatFabric. (2021, September 9). S.O.V.A. - A new Android Banking trojan with fowl intentions. Retrieved February 6, 2023.
Open source URL - [13]cyble_drinik_1022
Cyble. (2022, October 27). Drinik Malware Returns With Advanced Capabilities Targeting Indian Taxpayers. Retrieved November 17, 2024.
Open source URL - [14]cyble_chameleon_0423
Cyble Research & Intelligence Labs. (2023, April 13). Banking Trojan targeting mobile users in Australia and Poland. Retrieved August 16, 2023.
Open source URL - [15]ThreatFabric_Chameleon_Dec2023
ThreatFabric. (2023, December 21). Android Banking Trojan Chameleon can now bypass any Biometric Authentication. Retrieved July 7, 2025.
Open source URL - [16]Talos Gustuff Apr 2019
Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019.
Open source URL - [17]ZimperiumOrtegaPratapagiri_GodFather_Jun2025
Ortega, F. Pratapagiri, V. (2025, June 18). Your Mobile App, Their Playground: The Dark Side of Virtualization. Retrieved July 16, 2025.
Open source URL - [18]BlackBerry Bahamut
The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.
Open source URL - [19]lookout_bouldspy_0423
Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.
Open source URL - [20]Threat Fabric Exobot
Threat Fabric. (2017, February). Exobot - Android banking Trojan on the rise. Retrieved October 29, 2020.
Open source URL - [21]Cofense Anubis
M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved September 25, 2024.
Open source URL - [22]Cybereason EventBot
D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.
Open source URL - [23]Bleeipng Computer Escobar
B. Toulas. (2022, March 12). Android malware Escobar steals your Google Authenticator MFA codes. Retrieved September 28, 2023.
Open source URL - [24]ThreatFabric_Crocodilus_March2025
ThreatFabric. (2025, March 28). Exposing Crocodilus: New Device Takeover Malware Targeting Android Devices. Retrieved November 24, 2025.
Open source URL - [25]Threat Fabric Cerberus
Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.
Open source URL - [26]ESET_VajraSpy_Feb2024
Stefanko, L. (2024, February 1). VajraSpy: A Patchwork of espionage apps. Retrieved October 27, 2025.
Open source URL - [27]NIST Mobile Threat CatalogueAUT-13Open source URL
- [28]NIST Mobile Threat CatalogueAUT-13Open source URL
- [29]Zeltser-Keyboard
Lenny Zeltser. (2016, July 30). Security of Third-Party Keyboard Apps on Mobile Devices. Retrieved December 21, 2016.
Open source URL - [30]mitre-attackT1417.001Open source URL
- [31]mitre-attackT1417.001Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.