T1517: Access Notifications
Adversaries may collect data within notifications sent by the operating system or other applications. Notifications may contain sensitive data such as one-time authentication codes sent over SMS, email, or other mediums. In the case of Credential Access, adversaries may attempt to intercept one-time code sent to the device. Adversaries can also dismiss notifications to prevent the user from noticing that the notification has arrived and can trigger action buttons contained within notifications.[1]
Security context for executives and security teams
Access Notifications matters because Android notifications often contain business-sensitive content, including one-time authentication codes. If a malicious app can read, dismiss, or act on notifications, it may weaken MFA workflows and hide activity from the user. For leaders, this is less about one alert and more about whether mobile governance can prove which apps are allowed to see notification data on managed Android devices.
Executive priority
Prioritize this where Android devices are used for workforce access, banking/payment workflows, privileged administration, or MFA code delivery. The decision value is to validate whether EMM/MDM policy, user guidance, and application security requirements reduce exposure to apps that can access notification content. This also supports audit evidence for mobile access controls and incident response decisions when account takeover or suspicious mobile activity is suspected.
Technical view
For SOC, detection engineering, and IR teams, treat T1517 as Android mobile telemetry validation. ATT&CK provides no official detection text, but it maps a detection strategy, DET0611, to this behavior. Validate whether managed devices expose evidence of applications with notification-related access, suspicious notification dismissal or action behavior where available, risky app installation sources, and mobile security alerts. Relationship context shows this technique is used by multiple Android malware entries and one campaign, so triage should include installed-app review, device compliance state, and whether sensitive OTP or application notifications were present on the device during the suspected window.
Likely telemetry
- Android EMM/MDM inventory, compliance, and policy enforcement records
- Installed application inventory, package metadata, app source, and version history
- Device permission and special-access state where available, especially notification-related access
- Mobile threat defense or endpoint security alerts for Android applications
- Authentication logs showing OTP, MFA, or account access events correlated to the mobile device/user
Detection direction
- Confirm whether DET0611 or equivalent mobile detection logic is implemented and mapped to Android notification access behavior.
- Tune detections around newly installed or untrusted apps that gain access to notification content, especially on devices used for MFA or sensitive business applications.
- Correlate mobile app events with identity logs; notification access becomes higher priority when followed by successful authentication, MFA changes, or account activity anomalies.
- Watch for blind spots: unmanaged Android devices, BYOD devices with limited telemetry, third-party app stores, and lack of visibility into special app access settings.
- Expect false positives from legitimate productivity, wearable, accessibility, or notification-management apps; triage should consider business justification, publisher trust, installation source, and device ownership.
Mitigation priorities
- Use enterprise policy through EMM/MDM to restrict risky device behavior and enforce mobile compliance where feasible.
- Provide user guidance on avoiding unnecessary notification access grants and risky app installation behavior.
- Reduce sensitive content in notifications for enterprise applications where application developer guidance can be applied.
- Review MFA delivery methods and avoid over-reliance on notification-exposed one-time codes for high-risk access paths where stronger alternatives are available.
- During incidents, revoke sessions or credentials as appropriate and review mobile device app inventory before restoring trust in the device.
Additional notes and limits
This object is Android-specific and has no ATT&CK tactic listed in the supplied fields. ATT&CK’s description explicitly highlights sensitive notification content, one-time authentication codes, dismissal of notifications, and triggering notification action buttons. The relationship set is useful for prioritization because several Android malware/software entries are mapped as using this behavior, but those mappings should not be interpreted as proof of current exposure in any specific environment.
Official detection text is not provided, and the supplied DET0611 relationship does not include detection details. Local telemetry availability will vary significantly by Android version, EMM/MDM configuration, BYOD policy, and mobile security tooling. This take does not assert active exploitation, specific attribution, or guaranteed detection coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Access Notifications
Adversaries may collect data within notifications sent by the operating system or other applications. Notifications may contain sensitive data such as one-time authentication codes sent over SMS, email, or other mediums. In the case of Credential Access, adversaries may attempt to intercept one-time code sent to the device. Adversaries can also dismiss notifications to prevent the user from noticing that the notification has arrived and can trigger action buttons contained within notifications.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
S1061: AbstractEmu
AbstractEmu is mobile malware that was first seen in Google Play and other third-party stores in October 2021. It was discovered in 19 Android applications, of which at least 7 abused known Android exploits for obtaining root permissions. AbstractEmu was observed primarily impacting users in the United States, however victims are believed to be across a total of 17 countries.[1]
S1195: SpyC23
SpyC23 is a mobile malware that has been used by APT-C-23 since at least 2017. SpyC23 has been observed primarily targeting Android devices in the Middle East.[1]
There are multiple close variants of SpyC23, such as VAMP[2], GnatSpy[3], Desert Scorpion and FrozenCell, which add some additional functionality but are not significantly different from the original malware.
S0432: Bread
Bread was a large-scale billing fraud malware family known for employing many different cloaking and obfuscation techniques in an attempt to continuously evade Google Play Store’s malware detection. 1,700 unique Bread apps were detected and removed from the Google Play Store before being downloaded by users.[1]
S0485: Mandrake
Mandrake is a sophisticated Android espionage platform that has been active in the wild since at least 2016. Mandrake is very actively maintained, with sophisticated features and attacks that are executed with surgical precision.
Mandrake has gone undetected for several years by providing legitimate, ad-free applications with social media and real reviews to back the apps. The malware is only activated when the operators issue a specific command.[1]
S1083: Chameleon
Chameleon is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, Chameleon has been observed targeting users in Australia and Poland by masquerading as official applications. A new variant of Chameleon has expanded its targets to include Android users in the United Kingdom and Italy.[1][2]
S0425: Corona Updates
Corona Updates is Android spyware that took advantage of the Coronavirus pandemic. The campaign distributing this spyware is tracked as Project Spy. Multiple variants of this spyware have been discovered to have been hosted on the Google Play Store.[1]
S1062: S.O.V.A.
S.O.V.A. is an Android banking trojan that was first identified in August 2021 and has subsequently been found in a variety of applications, including banking, cryptocurrency wallet/exchange, and shopping apps. S.O.V.A., which is Russian for "owl", contains features not commonly found in Android malware, such as session cookie theft.[1][2]
S1077: Hornbill
S9006: VajraSpy
VajraSpy is Android malware distributed via trojanized messaging and news applications. It has been used to target individuals in Pakistan and India since at least 2021 and has been delivered through the Google Play Store, malicious domains, and other uncontrolled distribution channels. VajraSpy is attributed with high confidence to Patchwork which has used the malware to conduct targeted espionage, primarily against devices in Pakistan.[1][2][3]
S1092: Escobar
S0489: WolfRAT
S1067: FluBot
FluBot is a multi-purpose mobile banking malware that was first observed in Spain in late 2020. It primarily spread through European countries using a variety of SMS phishing messages in multiple languages.[1][2] An international law enforcement operation of 11 countries eventually disrupted the spread of FluBot.[3]
C0033: C0033
C0033 was a PROMETHIUM campaign during which they used StrongPity to target Android users. C0033 was the first publicly documented mobile campaign for PROMETHIUM, who previously used Windows-based techniques.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 008950d8482a… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]ESET 2FA Bypass
Lukáš Štefanko. (2019, June 17). Malware sidesteps Google permissions policy with new 2FA bypass technique. Retrieved September 15, 2019.
Open source URL - [2]lookout_abstractemu_1021
P Shunk, K Balaam. (2021, October 28). Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign. Retrieved February 6, 2023.
Open source URL - [3]welivesecurity_apt-c-23
Stefanko, L. (2020, September 30). APT‑C‑23 group evolves its Android spyware. Retrieved March 4, 2024.
Open source URL - [4]sophos_android_apt_spyware
Kohli, P. (2021, November 23). Android APT spyware, targeting Middle East victims, enhances evasiveness. Retrieved November 17, 2024.
Open source URL - [5]SentinelLabs AridViper 2023
Delamotte, A. (2023, November 6). Arid Viper | APT’s Nest of SpyC23 Malware Continues to Target Android Devices. Retrieved December 2, 2024.
Open source URL - [6]Cyware APT-C-23 2020
Cyware. (2020, October 2). APT‑C‑23 is Still Active and Enhancing its Mobile Spying Capabilities. Retrieved December 2, 2024.
Open source URL - [7]welivesec_strongpity
Stefanko, L. (2023, January 10). StrongPity espionage campaign targeting Android users. Retrieved January 31, 2023.
Open source URL - [8]Check Point-Joker
Hazum, A., Melnykov, B., Wernik, I.. (2020, July 9). New Joker variant hits Google Play with an old trick. Retrieved July 20, 2020.
Open source URL - [9]Bitdefender Mandrake
R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020.
Open source URL - [10]cyble_chameleon_0423
Cyble Research & Intelligence Labs. (2023, April 13). Banking Trojan targeting mobile users in Australia and Poland. Retrieved August 16, 2023.
Open source URL - [11]TrendMicro Coronavirus Updates
T. Bao, J. Lu. (2020, April 14). Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.
Open source URL - [12]threatfabric_sova_0921
ThreatFabric. (2021, September 9). S.O.V.A. - A new Android Banking trojan with fowl intentions. Retrieved February 6, 2023.
Open source URL - [13]lookout_hornbill_sunbird_0221
Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.
Open source URL - [14]ESET_VajraSpy_Feb2024
Stefanko, L. (2024, February 1). VajraSpy: A Patchwork of espionage apps. Retrieved October 27, 2025.
Open source URL - [15]Bleeipng Computer Escobar
B. Toulas. (2022, March 12). Android malware Escobar steals your Google Authenticator MFA codes. Retrieved September 28, 2023.
Open source URL - [16]Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL - [17]proofpoint_flubot_0421
Crista Giering, F. Naves, Andrew Conway, Adam McNeil . (2021, April 27). FluBot Android Malware Spreading Rapidly Through Europe, May Hit U.S. Soon. Retrieved February 28, 2023.
Open source URL - [18]checkpoint_flixonline_0421
Aviran Hazum, Bodgan Melnykov, Israel Wenik. (2021, April 7). New Wormable Android Malware Spreads by Creating Auto-Replies to Messages in WhatsApp. Retrieved January 26, 2024.
Open source URL - [19]Android Notification Listeners
Android. (n.d.). DevicePolicyManager. Retrieved September 15, 2019.
Open source URL - [20]nccgroup_sharkbot_0322
RIFT: Research and Intelligence Fusion Team. (2022, March 3). SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store. Retrieved January 18, 2023.
Open source URL - [21]ESET 2FA Bypass
Lukáš Štefanko. (2019, June 17). Malware sidesteps Google permissions policy with new 2FA bypass technique. Retrieved September 15, 2019.
Open source URL - [22]mitre-attackT1517Open source URL
- [23]mitre-attackT1517Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.