aol.pm

Suppress Application Icon

Subtechnique · ATTACK:mobile:T1628.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1628.001",
  "title": "Suppress Application Icon",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1628/001",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f05fc151-aa62-47e3-ae57-2d1b23d64bf6",
  "external_id": "T1628.001",
  "domain": "mobile",
  "created": "2022-03-30T20:06:22.194Z",
  "modified": "2025-10-24T17:49:35.410Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "defense-evasion"
  ],
  "source_references": [
    {
      "source_name": "Android 10 Limitations to Hiding App Icons",
      "url": "https://source.android.com/setup/start/android-10-release#limitations_to_hiding_app_icons"
    },
    {
      "source_name": "LauncherApps getActivityList",
      "url": "https://developer.android.com/reference/kotlin/android/content/pm/LauncherApps#getactivitylist"
    },
    {
      "source_name": "sunny-stolen-credentials",
      "url": "https://www.welivesecurity.com/2017/02/22/sunny-chance-stolen-credentials-malicious-weather-app-found-google-play/"
    },
    {
      "source_name": "android-trojan-steals-paypal-2fa",
      "url": "https://www.welivesecurity.com/2018/12/11/android-trojan-steals-money-paypal-accounts-2fa/"
    },
    {
      "source_name": "bankbot-spybanker",
      "url": "https://www.cyber.nj.gov/threat-landscape/malware/trojans/bankbot-spy-banker"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--049a5149-00c9-492a-8ffb-463f3d0cd910

Android 10 Limitations to Hiding App Icons · LauncherApps getActivityList

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cfbea52-d6ab-467f-97e5-8c74b332b16f

Lookout Uyghur Campaign

ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e29a9ce-ed11-44ae-b66e-8b90ee79de6a

Threat Fabric Cerberus

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f7428d7-6f6e-40d0-aedb-cb0578875ff9

SecureList BusyGasper

ATTACK:mobile:T1628.001 → subtechnique-of → ATTACK:mobile:T1628

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--209aa948-393c-46b0-9488-ef93a6252438

ATTACK:mobile:S0525 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38634e49-f19e-41bc-bb6d-e711f0cabd91

WeLiveSecurity AdDisplayAshas

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ae0c45f-4ff0-4296-aaf4-c3e0d2e355e3

Cybereason FakeSpy

ATTACK:mobile:S0423 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57293fc9-8838-4acd-a16f-48f516d0921e

ThreatFabric Ginp

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60782df8-1e96-48eb-a6b7-843c94b32b59

threatfabric_sova_0921

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--628435f7-7d1e-40f1-a29a-7c5861b14c7d

ATTACK:mobile:S0302 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7258542e-029b-45b9-be69-6e76d9c93b35

ESET-Twitoor

ATTACK:mobile:S0440 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d6bba99-ea81-42bc-b02a-e5e98b34a688

CheckPoint Agent Smith

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bc0abc2-a413-4c05-b2b8-2a92d9cc5556

FlexiSpy-Features · FortiGuard-FlexiSpy

ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9951d8c0-d210-4776-808b-421b613f244f

securelist rotexy 2018

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99fabe9d-0202-4d12-aa7c-34e2a15b2648

welivesecurity_apt-c-23

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0d0541d-caeb-43c0-906c-2e1e2ec25f69

Group IB Gustuff Mar 2019

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd6829ee-dc51-477b-9739-1cd1cd304b6c

Lookout Desert Scorpion

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c574251b-93ad-4f55-8b84-2700dfab4622

Bitdefender Mandrake

ATTACK:mobile:S0419 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc3cf438-7206-46df-a4a4-999472ea6a9a

CheckPoint SimBad 2019

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3e06522-2a30-4d56-801e-9461178b80ce

Zscaler TikTok Spyware

ATTACK:mobile:S1103 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d956ffe6-9847-45f6-8ebe-479e93aa68d9

checkpoint_flixonline_0421

ATTACK:mobile:S1054 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e245e45a-71a8-408d-8f32-7b7337bffc26

cyble_drinik_1022

ATTACK:mobile:S0311 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed48a86f-e55f-4abf-8f18-98591b756399

paloalto_yispecter_1015

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f31490e8-ef81-40d5-bba9-24ca580d2ee6

Bitdefender - Triout 2018

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.