aol.pm

Keylogging

Subtechnique · ATTACK:mobile:T1417.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1417.001",
  "title": "Keylogging",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1417/001",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b1c95426-2550-4621-8028-ceebf28b3a47",
  "external_id": "T1417.001",
  "domain": "mobile",
  "created": "2022-04-05T19:45:03.000Z",
  "modified": "2026-05-12T15:12:00.707Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "collection",
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Zeltser-Keyboard",
      "url": "https://zeltser.com/third-party-keyboards-security/"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-13.html",
      "external_id": "AUT-13"
    }
  ]
}

Explicit source assertions (23)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1afaf0fe-810e-49c7-8141-de4d56997aad

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S1055 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34dd5c26-eec9-4288-8e53-677271d490b2

nccgroup_sharkbot_0322

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34f9aed0-48a7-4815-8456-5541a7b8210f

Lookout-Monokle

ATTACK:mobile:M1012 → mitigates → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bf4b093-a1a3-48da-9236-bce9514765eb

Samsung Keyboards

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b3cfd7c-5e41-4d9e-8879-b126ba66eaf1

SecureList BusyGasper

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4dcbb081-a0b3-4b80-a63e-28547cb6f89c

cleafy_brata_0122 · mcafee_brata_0421 · securelist_brata_0819

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51bf6ffc-85c7-4910-8821-9736a1ec60f1

FlexiSpy-Features

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--520c7112-9768-42c5-8917-1950efd182f9

threatfabric_sova_0921

ATTACK:mobile:S1054 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b74d347-4d28-401f-9ac2-b3e1c9428bab

cyble_drinik_1022

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75a8614f-bf92-455d-b2ef-7085aff9a64d

cyble_chameleon_0423 · ThreatFabric_Chameleon_Dec2023

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cae8c80-c603-4352-a704-f3a2f4aa4a56

Talos Gustuff Apr 2019

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8128aebb-c665-4939-9615-aee9125b6373

ZimperiumOrtegaPratapagiri_GodFather_Jun2025

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9858ae0b-140b-4dd2-8ba9-1ef22183dec3

BlackBerry Bahamut

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab67b233-2c3d-4ac2-a3f0-13b6484ea920

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca568149-9971-4d15-b3db-ff7dabd49695

lookout_bouldspy_0423

ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca8c38e6-8343-4f5e-929d-2759a0d49d59

Threat Fabric Exobot

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d01b311d-8741-4b58-b127-88fecb2b0544

Cofense Anubis

ATTACK:mobile:T1417.001 → subtechnique-of → ATTACK:mobile:T1417

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d09a4d42-45bd-4b2a-aef4-3aa3982115ad

ATTACK:mobile:S0478 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df036f55-f749-4dad-9473-d69535e0f98d

Cybereason EventBot

ATTACK:mobile:S1092 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e95ac47c-8822-4ce5-bd65-f61ca873854b

Bleeipng Computer Escobar

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2661ec3-9c63-4ad8-91a9-8bd0e50a0cc3

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2d05b16-3565-453e-9fbb-1c02146e17e1

Threat Fabric Cerberus

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1417.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f490d3fc-7ef0-4f6c-aebd-82dbb30ecf7b

ESET_VajraSpy_Feb2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.