LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1429: Audio Capture

Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.

Android and iOS, by default, require that applications request device microphone access from the user.

On Android devices, applications must hold the `RECORD_AUDIO` permission to access the microphone or the `CAPTURE_AUDIO_OUTPUT` permission to access audio output. Because Android does not allow third-party applications to hold the `CAPTURE_AUDIO_OUTPUT` permission by default, only privileged applications, such as those distributed by Google or the device vendor, can access audio output.[1] However, adversaries may be able to gain this access after successfully elevating their privileges. With the `CAPTURE_AUDIO_OUTPUT` permission, adversaries may pass the `MediaRecorder.AudioSource.VOICE_CALL` constant to `MediaRecorder.setAudioOutput`, allowing capture of both voice call uplink and downlink.[2]

On iOS devices, applications must include the `NSMicrophoneUsageDescription` key in their `Info.plist` file to access the microphone.[3]

MobileT1429TechniqueObject v3.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Audio Capture matters because a compromised or abusive mobile app can turn a phone into a collection device for conversations, surroundings, calls, or other sensitive audio. For executives and security leaders, this is less about generic malware and more about protecting high-value mobile users, sensitive meetings, legal/compliance discussions, and operational environments where phones are present. ATT&CK notes Android and iOS permission gates, but the relationship context shows this behavior is common enough across mobile spyware and RAT families to merit explicit mobile security validation.

Executive priority

Prioritize this as a mobile privacy, executive protection, and incident response readiness issue. Leaders should ask whether managed mobile devices are kept on recent OS versions, whether microphone permissions are reviewed for business justification, and whether the organization can produce evidence during an investigation showing which apps had microphone access. This is especially relevant for high-risk users and environments where recorded speech could affect negotiations, regulated data handling, or operational security.

Technical view

For Android and iOS, validate controls around microphone authorization and visibility. Android apps require RECORD_AUDIO for microphone access; CAPTURE_AUDIO_OUTPUT is normally limited to privileged applications but may become relevant after privilege elevation. iOS apps require NSMicrophoneUsageDescription in Info.plist to request microphone access. Since ATT&CK provides no official detection text, SOC and mobile security teams should base coverage validation on the related detection strategy DET0673, local MDM/mobile security telemetry, app inventory, permission state, OS version, jailbreak/root indicators where available, and investigations of apps with unjustified microphone access.

Likely telemetry

  • Mobile device inventory with Android/iOS platform and OS version
  • Installed application inventory and app provenance where available
  • Application permission state, especially microphone access on Android and iOS
  • Android manifest permissions such as RECORD_AUDIO and any indication of privileged audio-output access such as CAPTURE_AUDIO_OUTPUT
  • iOS app metadata such as NSMicrophoneUsageDescription where available

Detection direction

  • Confirm whether DET0673 or an equivalent internal detection strategy is implemented for mobile audio capture behavior; ATT&CK does not provide native detection guidance for this technique.
  • Tune around permission context: microphone access alone is not malicious, so prioritize apps with no business need, suspicious provenance, high-risk users, or co-occurring root/jailbreak/privilege-elevation signals.
  • Review Android cases where privileged permissions or elevated access could change expected access boundaries, especially around CAPTURE_AUDIO_OUTPUT and voice-call audio capture.
  • On iOS, validate whether app review, MDM, or forensic workflows can identify apps requesting microphone access through NSMicrophoneUsageDescription and correlate that with user and device risk.
  • Expect blind spots where mobile telemetry is limited by OS privacy controls, unmanaged/BYOD scope, lack of app-permission history, or inability to inspect privileged or jailbroken devices.

Mitigation priorities

  • Keep mobile operating systems current, aligning with ATT&CK mitigation M1006 Use Recent OS Version, because newer releases may add security architecture improvements as well as patches.
  • Provide user guidance, aligning with M1011, on reviewing microphone permission prompts, denying unnecessary access, and reporting unexpected microphone indicators or suspicious apps.
  • Apply risk-based mobile app governance: inventory apps, review microphone permissions for business justification, and reduce unnecessary access for managed devices.
  • For high-risk users, validate incident response procedures for mobile collection: app inventory capture, permission review, OS version check, and escalation when spyware or RAT indicators are present.
  • Use local policy and compliance requirements to define evidence retention for device posture, app permissions, and user guidance completion.
Additional notes and limits

The relationship context associates Audio Capture with multiple mobile campaigns, groups, and software families, including Android and iOS examples, which supports treating it as a recurring mobile surveillance behavior rather than a niche permission issue. However, those relationships do not prove current activity in any specific environment. The strongest defensive value is validating whether mobile governance and investigations can distinguish legitimate microphone use from suspicious or unjustified access.

ATT&CK lists no tactics for this object and provides no official detection text. The supplied fields identify platforms, permissions, external references, mitigations M1006 and M1011, and related detection strategy DET0673, but do not include detailed analytic logic. Local device management coverage, BYOD policy, OS restrictions, and available mobile telemetry will determine practical detectability.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Audio Capture

Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.

Android and iOS, by default, require that applications request device microphone access from the user.

On Android devices, applications must hold the `RECORD_AUDIO` permission to access the microphone or the `CAPTURE_AUDIO_OUTPUT` permission to access audio output. Because Android does not allow third-party applications to hold the `CAPTURE_AUDIO_OUTPUT` permission by default, only privileged applications, such as those distributed by Google or the device vendor, can access audio output.[1] However, adversaries may be able to gain this access after successfully elevating their privileges. With the `CAPTURE_AUDIO_OUTPUT` permission, adversaries may pass the `MediaRecorder.AudioSource.VOICE_CALL` constant to `MediaRecorder.setAudioOutput`, allowing capture of both voice call uplink and downlink.[2]

On iOS devices, applications must include the `NSMicrophoneUsageDescription` key in their `Info.plist` file to access the microphone.[3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

GroupMobile

G0112: Windshift

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.[1][2][3]

MalwareMobile

S9005: DocSwap

DocSwap is an Android malware first identified in 2025, and attributed to Kimsuky. DocSwap’s name is a combination of its Korean name “문서열람 인증 앱” (Document Viewing Authentication App) and a phishing page masquerading as CoinSwap at the C2 address. Based on DocSwap’s name and Korean-language strings, DocSwap potentially targets mobile device users in South Korea. Several variants of DocSwap exist; one of the latest samples indicates that the adversary added a native decryption function that decrypts an internal APK.[1][2]

Android
MalwareMobile

S0507: eSurv

eSurv is mobile surveillanceware designed for the lawful intercept market that was developed over the course of many years.[1]

AndroidiOS
MalwareMobile

S1079: BOULDSPY

BOULDSPY is an Android malware, detected in early 2023, with surveillance and remote-control capabilities. Analysis of exfiltrated C2 data suggests that BOULDSPY primarily targeted minority groups in Iran.[1]

Android
ToolMobile

S0408: FlexiSpy

FlexiSpy is sophisticated surveillanceware for iOS and Android. Publicly-available, comprehensive analysis has only been found for the Android version.[1][2]

FlexiSpy markets itself as a parental control and employee monitoring application.[3]

Android
MalwareMobile

S0328: Stealth Mango

Stealth Mango is Android malware that has reportedly been used to successfully compromise the mobile devices of government officials, members of the military, medical professionals, and civilians. The iOS malware known as Tangelo is believed to be from the same developer. [1]

Android
Relationship explorer

All related ATT&CK context

uses · MalwareS0327: SkygofreeMobileuses · MalwareS9005: DocSwapMobileuses · MalwareS0316: Pegasus for AndroidMobileuses · MalwareS0295: RCSAndroidMobileuses · MalwareS0507: eSurvMobileuses · MalwareS1079: BOULDSPYMobileuses · MalwareS0318: XLoader for AndroidMobileuses · MalwareS1082: SunbirdMobileuses · ToolS0408: FlexiSpyMobileuses · MalwareS0489: WolfRATMobileuses · MalwareS0328: Stealth MangoMobileuses · MalwareS0535: Golden CupMobileuses · MalwareS0550: DoubleAgentMobileuses · MalwareS0558: Tiktok ProMobileuses · MalwareS1077: HornbillMobileuses · GroupG0112: WindshiftMobileuses · MalwareS9006: VajraSpyMobileuses · MalwareS0655: BusyGasperMobileuses · MalwareS1231: GodFatherMobileuses · MalwareS1080: FakecallsMobileuses · MalwareS1061: AbstractEmuMobileuses · MalwareS0505: Desert ScorpionMobileuses · MalwareS1069: TangleBotMobileuses · MalwareS0320: DroidJackMobile
Mitigations

Mitigation direction

MitigationMobile

M1006: Use Recent OS Version

New mobile operating system versions bring not only patches against discovered vulnerabilities but also often bring security architecture improvements that provide resilience against potential vulnerabilities or weaknesses that have not yet been discovered. They may also bring improvements that block use of observed adversary techniques.

MitigationMobile

M1011: User Guidance

Describes any guidance or training given to users to set particular configuration settings or avoid specific potentially risky behaviors.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
3.1
Created
Modified
Raw hash
6289c736e9f9fc19...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.13.1Current bundle6289c736e9f9…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Android Permissions

    Google. (2021, August 11). Manifest.permission. Retrieved September 22, 2021.

    Open source URL
  2. [2]
    Manifest.permission

    Android Developers. (2022, March 17). Voice Call. Retrieved April 1, 2022.

    Open source URL
  3. [3]
    Requesting Auth-Media Capture

    Apple Developers. (n.d.). Requesting Authorization for Media Capture on iOS. Retrieved April 1, 2022.

    Open source URL
  4. [4]
    Kaspersky-Skygofree

    Nikita Buchka and Alexey Firsh. (2018, January 16). Skygofree: Following in the footsteps of HackingTeam. Retrieved September 24, 2018.

    Open source URL
  5. [5]
    EnkiWhiteHat_KimsukyDOCSWAP_Dec2025

    EnkiWhiteHat. (2025, December 16). Kimsuky Distributing Malicious Mobile App via QR Code. Retrieved January 8, 2026.

    Open source URL
  6. [6]
    S2W_DocSwap_Mar2025

    Kim, H., S2W TALON. (2025, March 13). Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer. Retrieved January 12, 2026.

    Open source URL
  7. [7]
    Lookout-PegasusAndroid

    Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017.

    Open source URL
  8. [8]
    TrendMicro-RCSAndroid

    Veo Zhang. (2015, July 21). Hacking Team RCSAndroid Spying Tool Listens to Calls; Roots Devices to Get In. Retrieved December 22, 2016.

  9. [9]
    Lookout eSurv

    A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.

    Open source URL
  10. [10]
    lookout_bouldspy_0423

    Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.

    Open source URL
  11. [11]
    TrendMicro-XLoader

    Lorin Wu. (2018, April 19). XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing. Retrieved July 6, 2018.

    Open source URL
  12. [12]
    lookout_hornbill_sunbird_0221

    Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.

    Open source URL
  13. [13]
    CyberMerchants-FlexiSpy

    Actis B. (2017, April 22). FlexSpy Application Analysis. Retrieved September 4, 2019.

  14. [14]
    Talos-WolfRAT

    W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.

    Open source URL
  15. [15]
    Lookout-StealthMango

    Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.

    Open source URL
  16. [16]
    Symantec GoldenCup

    R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.

    Open source URL
  17. [17]
    Lookout Uyghur Campaign

    A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.

    Open source URL
  18. [18]
    Zscaler TikTok Spyware

    S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.

    Open source URL
  19. [19]
    BlackBerry Bahamut

    The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.

    Open source URL
  20. [20]
    ESET_VajraSpy_Feb2024

    Stefanko, L. (2024, February 1). VajraSpy: A Patchwork of espionage apps. Retrieved October 27, 2025.

    Open source URL
  21. [21]
    K7Dhanalakshmi_VajraSpy_April2022

    Dhanalakshmi. (2022, April 19). VajraSpy – An Android RAT. Retrieved November 5, 2025.

    Open source URL
  22. [22]
    SecureList BusyGasper

    Alexey Firsh. (2018, August 29). BusyGasper – the unfriendly spy. Retrieved October 1, 2021.

    Open source URL
  23. [23]
    MerkleScience_Godfather_April2023

    Merkle Science. (2023, April 25). The Godfather Android Malware: Threat under the lens. Retrieved July 16, 2025.

    Open source URL
  24. [24]
    kaspersky_fakecalls_0422

    Igor Golovin. (2022, April 11). Fakecalls: a talking Trojan. Retrieved July 21, 2023.

    Open source URL
  25. [25]
    lookout_abstractemu_1021

    P Shunk, K Balaam. (2021, October 28). Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign. Retrieved February 6, 2023.

    Open source URL
  26. [26]
    Lookout Desert Scorpion

    A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.

    Open source URL
  27. [27]
    cloudmark_tanglebot_0921

    Felipe Naves, Andrew Conway, W. Stuart Jones, Adam McNeil . (2021, September 23). TangleBot: New Advanced SMS Malware Targets Mobile Users Across U.S. and Canada with COVID-19 Lures. Retrieved February 28, 2023.

    Open source URL
  28. [28]
    Zscaler-SuperMarioRun

    Viral Gandhi. (2017, January 12). Super Mario Run Malware #2 – DroidJack RAT. Retrieved January 20, 2017.

    Open source URL
  29. [29]
    welivesecurity_apt-c-23

    Stefanko, L. (2020, September 30). APT‑C‑23 group evolves its Android spyware. Retrieved March 4, 2024.

    Open source URL
  30. [30]
    sophos_android_apt_spyware

    Kohli, P. (2021, November 23). Android APT spyware, targeting Middle East victims, enhances evasiveness. Retrieved November 17, 2024.

    Open source URL
  31. [31]
    SentinelLabs AridViper 2023

    Delamotte, A. (2023, November 6). Arid Viper | APT’s Nest of SpyC23 Malware Continues to Target Android Devices. Retrieved December 2, 2024.

    Open source URL
  32. [32]
    Cyware APT-C-23 2020

    Cyware. (2020, October 2). APT‑C‑23 is Still Active and Enhancing its Mobile Spying Capabilities. Retrieved December 2, 2024.

    Open source URL
  33. [33]
    threatpost AndroidSpyware 2020

    O'Donnell, L. (2020, September 30). Android Spyware Variant Snoops on WhatsApp, Telegram Messages. Retrieved January 10, 2025.

    Open source URL
  34. [34]
    Meta Adversarial Threat Report 2022

    Agranovich, D., et al. (2022, April). Adversarial Threat Report. Retrieved April 2, 2024.

    Open source URL
  35. [35]
    Lookout_DCHSpy_July2025

    Albrecht, J., Islamoglu, A. (2025, July 21). Lookout Discovers Iranian APT MuddyWater Leveraging DCHSpy During Israel-Iran Conflict . Retrieved September 19, 2025.

    Open source URL
  36. [36]
    welivesec_strongpity

    Stefanko, L. (2023, January 10). StrongPity espionage campaign targeting Android users. Retrieved January 31, 2023.

    Open source URL
  37. [37]
    Lookout Dark Caracal Jan 2018

    Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.

    Open source URL
  38. [38]
    Android Capture Sensor 2019

    Android Developers. (, January). Android 9+ Privacy Changes . Retrieved August 27, 2019.

    Open source URL
  39. [39]
    FirshSecureList LightSpy 2020

    Firsh, A., et al. (2020, March 26). iOS exploit chain deploys LightSpy feature-rich malware. Retrieved January 13, 2025.

    Open source URL
  40. [40]
    MelikovBlackBerry LightSpy 2024

    Melikov, D. (2024, April 11). LightSpy Returns: Renewed Espionage Campaign Targets Southern Asia, Possibly India. Retrieved January 14, 2025.

    Open source URL
  41. [41]
    Threatfabric LightSpy 2023

    ThreatFabric. (2023, October 2). LightSpy mAPT Mobile Payment System Attack. Retrieved January 17, 2025.

    Open source URL
  42. [42]
    Threatfabric LightSpy 2024

    ThreatFabric. (2024, October 29). LightSpy: Implant for iOS. Retrieved January 30, 2025.

    Open source URL
  43. [43]
    LinkedIn Dmitry LightSpy 2025

    Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.

    Open source URL
  44. [44]
    Palo Alto HenBox

    A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.

    Open source URL
  45. [45]
    fb_arid_viper

    Flossman, M., Scott, M. (2021, April). Technical Paper // Taking Action Against Arid Viper. Retrieved November 17, 2024.

    Open source URL
  46. [46]
    TrendMicro Coronavirus Updates

    T. Bao, J. Lu. (2020, April 14). Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.

    Open source URL
  47. [47]
    SWB Exodus March 2019

    Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved November 17, 2024.

    Open source URL
  48. [48]
    SecureList OpTriangulation 23Oct2023

    Kucherin, G., et al. (2023, October 23). The outstanding stealth of Operation Triangulation. Retrieved April 18, 2024.

    Open source URL
  49. [49]
    Lookout-EnterpriseApps

    Lookout. (2016, May 25). 5 active mobile threats spoofing enterprise apps. Retrieved December 19, 2016.

    Open source URL
  50. [50]
    forcepoint_bitter

    Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved March 1, 2024.

    Open source URL
  51. [51]
    Lookout-Pegasus

    Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.

    Open source URL
  52. [52]
    welivesecurity_ahrat_0523

    Lukas Stefanko. (2023, May 23). Android app breaking bad: From legitimate screen recording to file exfiltration within a year. Retrieved December 18, 2023.

    Open source URL
  53. [53]
    Zscaler-SpyNote

    Shivang Desai. (2017, January 23). SpyNote RAT posing as Netflix app. Retrieved January 26, 2017.

    Open source URL
  54. [54]
    Trend Micro Bouncing Golf 2019

    E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.

    Open source URL
  55. [55]
    Lookout-Monokle

    Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.

    Open source URL
  56. [56]
    Lookout ViperRAT

    M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020.

    Open source URL
  57. [57]
    Lookout FrozenCell

    Michael Flossman. (2017, October 5). FrozenCell: Multi-platform surveillance campaign against Palestinians. Retrieved November 11, 2020.

    Open source URL
  58. [58]
    Lookout-Dendroid

    Marc Rogers. (2014, March 6). Dendroid malware can take over your camera, record audio, and sneak into Google Play. Retrieved December 22, 2016.

    Open source URL
  59. [59]
    Cofense Anubis

    M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved September 25, 2024.

    Open source URL
  60. [60]
    ZimperiumGupta_RatMilad_Oct2022

    Gupta, N. (2022, October 5). We Smell A RatMilad Android Spyware. Retrieved August 27, 2025.

    Open source URL
  61. [61]
    Bleeipng Computer Escobar

    B. Toulas. (2022, March 12). Android malware Escobar steals your Google Authenticator MFA codes. Retrieved September 28, 2023.

    Open source URL
  62. [62]
    SecureList - ViceLeaker 2019

    GReAT. (2019, June 26). ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.

    Open source URL
  63. [63]
    Bitdefender - Triout 2018

    L. Arsene, C. Ochinca. (2018, August 20). Triout – Spyware Framework for Android with Extensive Surveillance Capabilities. Retrieved January 21, 2020.

    Open source URL
  64. [64]
    PaloAlto-SpyDealer

    Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018.

    Open source URL
  65. [65]
    Wandera-RedDrop

    Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved November 17, 2024.

    Open source URL
  66. [66]
    Android Permissions

    Google. (2021, August 11). Manifest.permission. Retrieved September 22, 2021.

    Open source URL
  67. [67]
    Android Privacy Indicators

    Google. (n.d.). Privacy Indicators. Retrieved April 20, 2022.

    Open source URL
  68. [68]
    Android Privacy Indicators

    Google. (n.d.). Privacy Indicators. Retrieved April 20, 2022.

    Open source URL
  69. [69]
    Manifest.permission

    Android Developers. (2022, March 17). Voice Call. Retrieved April 1, 2022.

    Open source URL
  70. [70]
    NIST Mobile Threat CatalogueAPP-19
    Open source URL
  71. [71]
    NIST Mobile Threat CatalogueAPP-19
    Open source URL
  72. [72]
    Requesting Auth-Media Capture

    Apple Developers. (n.d.). Requesting Authorization for Media Capture on iOS. Retrieved April 1, 2022.

    Open source URL
  73. [73]
    iOS Mic Spyware

    ZecOps Research Team. (2021, November 4). How iOS Malware Can Spy on Users Silently. Retrieved April 1, 2022.

    Open source URL
  74. [74]
    iOS Mic Spyware

    ZecOps Research Team. (2021, November 4). How iOS Malware Can Spy on Users Silently. Retrieved April 1, 2022.

    Open source URL
  75. [75]
    mitre-attackT1429
    Open source URL
  76. [76]
    mitre-attackT1429
    Open source URL
  77. [77]
    lookout_hornbill_sunbird_0221

    Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.

    Open source URL
  78. [78]
    Lookout Uyghur Campaign

    A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.

    Open source URL
  79. [79]
    Lookout-StealthMango

    Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.

    Open source URL
  80. [80]
    Lookout Uyghur Campaign

    A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.

    Open source URL
  81. [81]
    Lookout Dark Caracal Jan 2018

    Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use