aol.pm

Video Capture

Technique · ATTACK:mobile:T1512

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1512",
  "title": "Video Capture",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1512",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--d8940e76-f9c1-4912-bea6-e21c251370b6",
  "external_id": "T1512",
  "domain": "mobile",
  "created": "2019-08-09T16:14:58.254Z",
  "modified": "2026-05-12T15:12:00.721Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-19.html",
      "external_id": "APP-19"
    }
  ]
}

Explicit source assertions (43)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0328 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bcdeb29-6eed-4c96-a9ae-e56aadc4a5db

Lookout-StealthMango

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cabc5f9-045e-490c-a97f-efe00dbade86

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1208139a-5df5-40e9-ab7b-390f38530757

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--243bafe0-206c-4a17-94a6-4ff0492ebc7a

sophos_android_apt_spyware · threatpost AndroidSpyware 2020 · welivesecurity_apt-c-23

ATTACK:mobile:S1069 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d3198ff-a481-47ec-ae64-13d7be706929

cloudmark_tanglebot_0921

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e08820f-a81d-480e-9e60-f14db3e49080

Lookout-Monokle

ATTACK:mobile:S1092 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f9c31d2-2e6c-4e95-9058-c9a8def46865

Bleeipng Computer Escobar

ATTACK:mobile:S1080 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3115a062-e7d0-4eac-9d78-9a9c797e7546

kaspersky_fakecalls_0422

ATTACK:mobile:S1243 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32a28692-0297-40b9-b853-4996cf5541ec

Lookout_DCHSpy_July2025

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3abc80ad-4ea0-4e91-a170-f040469c2083

Talos-WolfRAT

ATTACK:mobile:S0535 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4819f391-01de-4525-992b-7e4a4f6667de

Symantec GoldenCup

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--492d5699-f885-411a-8431-254fcf33fb12

Android Capture Sensor 2019

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bdda427-2fff-428d-ba19-4bee5d2508e1

BlackBerry Bahamut

ATTACK:mobile:S0327 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d542595-1eb0-45aa-9702-9d494142b390

Kaspersky-Skygofree

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51b0a4fb-a308-4694-9437-95702a50ebd5

Lookout ViperRAT

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a277966-4559-487e-bdfb-7be6366ccdb6

SWB Exodus March 2019

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6132b084-b68b-41ea-9fc2-8e134df48602

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S0320 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6961eec4-8e31-4be1-88d9-dca682e38b8c

Zscaler-SuperMarioRun

ATTACK:mobile:S0292 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--725dc68b-e56d-42ac-b35e-651a7b3a2db8

forcepoint_bitter

ATTACK:mobile:S0425 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72a5350f-f0cf-4f44-82d5-28a25492c6af

TrendMicro Coronavirus Updates

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ba30703-c3aa-425a-9482-9e9941fd7038

Lookout Uyghur Campaign

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ded1b79-cf7c-435d-b6ed-2c8872f9393f

Lookout Uyghur Campaign

ATTACK:mobile:S0426 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8936c564-b11a-4c9e-a32a-76e7d7e0c8b0

TrendMicro Coronavirus Updates

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a961514-3372-4c3e-b7ee-e3d053c3d5f3

Lookout Desert Scorpion

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--991ef2f2-c196-4d5d-bd29-504ea25831f4

SecureList BusyGasper

ATTACK:mobile:S1128 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b5ec339-28f3-40b2-b5b2-450e1e303e78

Meta Adversarial Threat Report 2022

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b309c25a-6baf-4874-829d-63712a38652c

lookout_abstractemu_1021

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3442cff-8db5-4850-9fd3-64075e940c0a

K7Dhanalakshmi_VajraSpy_April2022 · ESET_VajraSpy_Feb2024

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4ef35e9-3dba-49c7-8842-a7dff403241f

Palo Alto HenBox

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b59b2f10-942b-455e-8166-1c9acb4b6824

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd99b570-5966-4337-8ab4-2d6f4afd0f7f

CyberMerchants-FlexiSpy

ATTACK:mobile:S0316 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be17dc63-5b0a-491a-be5f-132058444c3a

Lookout-PegasusAndroid

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c186864b-0af9-42eb-92ba-b8a6952e89b6

lookout_bouldspy_0423

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5db5bb5-9877-43cd-8851-5aa62405dcb2

SecureList - ViceLeaker 2019

ATTACK:mobile:S0295 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf26d49c-1d1b-4861-9d6e-959f4f15b73a

TrendMicro-RCSAndroid

ATTACK:mobile:S1126 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3d901d7-1ddd-476c-af65-15a1affc422f

fb_arid_viper

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5533ca1-d57e-4bbf-bf0c-d114e4b79078

lookout_hornbill_sunbird_0221

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dea15947-3a93-4ef6-94c4-ddd8b5bf4db5

LinkedIn Dmitry LightSpy 2025 · FirshSecureList LightSpy 2020 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S0301 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3a961ec-8184-4143-b8c2-c33ea0503678

Lookout-Dendroid

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eca69d9c-7c27-4147-ad7a-a1c30317df1d

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa222de8-ba3a-45c1-a7eb-d7502843cc2d

Zscaler TikTok Spyware

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--faf3396c-3a53-478c-b15c-7ff44ef4a5f5

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcb3a139-f644-45c9-8123-dfea0455143a

PaloAlto-SpyDealer

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.