aol.pm

Access Notifications

Technique · ATTACK:mobile:T1517

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1517",
  "title": "Access Notifications",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1517",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--39dd7871-f59b-495f-a9a5-3cb8cc50c9b2",
  "external_id": "T1517",
  "domain": "mobile",
  "created": "2019-09-15T15:26:08.183Z",
  "modified": "2026-05-12T15:12:00.627Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "collection",
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "ESET 2FA Bypass",
      "url": "https://www.welivesecurity.com/2019/06/17/malware-google-permissions-2fa-bypass/"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--006b3910-e9c3-4de8-ba49-dff36b1a3308

lookout_abstractemu_1021

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12df8ac7-06a4-4389-8d86-d354c4536e28

Cyware APT-C-23 2020 · SentinelLabs AridViper 2023 · sophos_android_apt_spyware · welivesecurity_apt-c-23

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16d969ca-59ae-4c87-888f-fa231ad863d1

welivesec_strongpity

ATTACK:mobile:S0432 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c7d2d48-ea9a-448f-891f-66f635c95f73

Check Point-Joker

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22708018-defd-4690-8b0f-fe47e11cb5d6

Bitdefender Mandrake

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a8fea40-69ba-4cfe-b577-c3112a60887a

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49c0c003-433c-467f-93b7-ca585aab8232

cyble_chameleon_0423

ATTACK:mobile:S0425 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a67b14a-e489-4e8f-b545-5bdf134e146e

TrendMicro Coronavirus Updates

ATTACK:mobile:M1013 → mitigates → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a96d87e-f70e-49dc-a272-c98aad672ce0

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62623afc-8222-4d59-b5d0-7bc1ccc7fadc

threatfabric_sova_0921

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c4a4766-cb63-4a3c-85ef-a1dba3be4a47

lookout_hornbill_sunbird_0221

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7dfad27-7bba-4593-87d1-86a5461cb957

ESET_VajraSpy_Feb2024

ATTACK:mobile:S1092 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc0b8984-f561-4453-a2be-9be8bd62561e

Bleeipng Computer Escobar

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e78b2cd9-ef73-45d9-9477-e2e95454e208

Talos-WolfRAT

ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eda3c5c4-d062-48d3-a78e-051f0c9d62f6

proofpoint_flubot_0421

ATTACK:mobile:S1103 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3ddf0be-ca7d-4984-b8e2-4e5958a2c83a

checkpoint_flixonline_0421

ATTACK:mobile:M1012 → mitigates → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4f4660c-6324-4da4-be2f-ac87fda85a45

Android Notification Listeners

ATTACK:mobile:S1055 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa5f3aea-2131-4690-8833-dc428fae2b22

nccgroup_sharkbot_0322

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.