Abuse Accessibility Features
Technique · ATTACK:mobile:T1453
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:T1453",
"title": "Abuse Accessibility Features",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1453",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--2204c371-6100-4ae0-82f3-25c07c29772a",
"external_id": "T1453",
"domain": "mobile",
"created": "2017-10-25T14:48:08.613Z",
"modified": "2026-05-12T15:12:00.622Z",
"version": "3.0",
"aliases": [
],
"tactics": [
"collection",
"credential-access"
],
"source_references": [
{
"source_name": "Google_AndroidAcsOverview",
"url": "https://support.google.com/accessibility/android/answer/6006564?hl=en&ref_topic=6007234&sjid=9936713164149272548-NA"
},
{
"source_name": "SahinSRLabs_FluBot_Dec2021",
"url": "https://www.srlabs.de/blog-post/flubot-abuses-accessibility-features-to-steal-data"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1453
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07ccc973-19fb-4926-953a-9ec205372683
cyble_chameleon_0423 · ThreatFabric_Chameleon_Dec2023ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1453
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0de00695-619e-401b-bcb4-0497ff107936
ESET_VajraSpy_Feb2024ATTACK:mobile:S1225 → uses → ATTACK:mobile:T1453
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--137ec7b1-8f78-4b03-8dec-f445800d36c1
TrendMicro_CherryBlos_July2023ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1453
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--183edec4-71b8-4122-a81b-102256e5db13
Cyble_Anubis_May2021ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1453
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bfd9b27-243b-46f7-927a-babc76db65d2
ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1453
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--967ca7e3-4a3a-448a-b649-88329918aced
EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1453
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc656065-d207-456e-a343-ea778ece5f69
MerkleScience_Godfather_April2023ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1453
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c30d659c-dd17-4fb0-9b88-2f29427f273b
SahinSRLabs_FluBot_Dec2021ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1453
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ceea7970-a921-4c59-9e28-de76af1d92fb
ThreatFabric_Crocodilus_March2025