aol.pm

Call Log

Subtechnique · ATTACK:mobile:T1636.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1636.002",
  "title": "Call Log",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1636/002",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--1d1b1558-c833-482e-aabb-d07ef6eae63d",
  "external_id": "T1636.002",
  "domain": "mobile",
  "created": "2022-04-01T13:12:23.522Z",
  "modified": "2026-05-12T15:12:00.622Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html",
      "external_id": "APP-13"
    }
  ]
}

Explicit source assertions (43)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00cac496-7350-4023-b29e-42c81e3c50bd

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05c57e75-04b8-4bf6-8022-2e89f74e4b76

Palo Alto HenBox

ATTACK:mobile:T1636.002 → subtechnique-of → ATTACK:mobile:T1636

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d82a9ed-4184-4f95-99f4-5ee467fe6594

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--161dc9cf-e49a-426a-a68c-4d3fa0bf9f25

K7Dhanalakshmi_VajraSpy_April2022 · ESET_VajraSpy_Feb2024

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21e179f2-49c9-4ec9-ac7a-b8eae8e15bd9

Talos-WolfRAT

ATTACK:mobile:S0292 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--290a627d-172d-494d-a0cc-685f480a1034

forcepoint_bitter · Lookout-EnterpriseApps

ATTACK:mobile:S1080 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2af26be3-f910-4700-ab14-9d14532601cc

kaspersky_fakecalls_0422

ATTACK:mobile:S0304 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2bedbf86-2ef0-45bf-950d-b9d072c03bdc

Kaspersky-WUC

ATTACK:mobile:S0289 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34351abd-1f58-420a-a893-ad822839815d

Lookout-Pegasus

ATTACK:mobile:S0425 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c874ffa-63c3-491f-8d8c-623b19a7fdad

TrendMicro Coronavirus Updates

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48486680-530c-4ed9-aca3-94969aa262b6

Lookout Dark Caracal Jan 2018

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ed97a0d-2fcf-4c53-8aaa-21e174b28309

welivesec_strongpity

ATTACK:mobile:S0316 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f366c8c-9c70-44ed-baa8-d433d5dbfe49

Lookout-PegasusAndroid

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--506d657b-1634-442e-8179-7187f82feb3a

Lookout Uyghur Campaign

ATTACK:mobile:S0329 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50c81a85-8c70-48df-a338-8622d2debc74

Lookout-StealthMango

ATTACK:mobile:S0328 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51457698-e98b-435a-88c2-75a82cdc2bda

Lookout-StealthMango

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5340f466-abf0-4bb9-a7e9-44694014561d

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Shoshin_Kaspersky LightSpy 2020 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5738479d-47fb-4d6f-9f04-5ce988327694

welivesecurity_ahrat_0523

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5aa167b8-4166-440b-b49f-bf1bab597237

SecureList - ViceLeaker 2019

ATTACK:mobile:S0182 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f63395f-a826-45e2-8d3b-dccd6375f54d

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7017085c-c612-48b2-b655-e18d7822d0e7

PaloAlto-SpyDealer

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f47cd7f-9090-4f19-89e0-db75c586547a

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f4e1ac1-145e-4983-b735-7f70003893aa

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0463 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--891edea2-817c-4eeb-9991-b6e095c269a8

Google Project Zero Insomnia

ATTACK:mobile:S1054 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b3e74ad-7cc4-4ed2-84d2-c745e6997711

cyble_drinik_1022

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9432fabf-9487-469c-86c9-b9d26b013c85

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a153f40b-ba34-4419-9189-d61b5cd29802

threatpost AndroidSpyware 2020

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a81431c4-ac34-4b63-9647-eb7c8e529e03

Lookout Uyghur Campaign

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7c8abf7-d4e4-40a4-aa2a-ee995a6f4f10

lookout_abstractemu_1021

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb77cfbe-ac95-4cc2-acbc-8cefa15b9387

lookout_hornbill_sunbird_0221

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bef936d5-736e-491a-9c30-37b8362a5d96

lookout_bouldspy_0423

ATTACK:mobile:S1092 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--befa3b5a-e4f4-4ed3-ada1-860a034284d2

Bleeipng Computer Escobar

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c50b4da7-f0e1-4f6d-969c-dbc739d49d7c

Zscaler TikTok Spyware

ATTACK:mobile:S0320 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c65661a6-6047-4901-ac2c-3ca4b1bbbb28

Zscaler-SuperMarioRun

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce645a25-160f-443d-b288-fdd108b78a06

Lookout ViperRAT

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d63f27cf-95a3-42bb-86dd-dc18e22cb898

Lookout-Monokle

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db34a2c8-01e0-4cd3-a497-0f4bca36812a

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S1069 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dbef53a9-f9c4-4582-8e93-349ad488de12

cloudmark_tanglebot_0921

ATTACK:mobile:S1243 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2128a08-dc84-4a1e-a090-172b4591ea6f

Lookout_DCHSpy_July2025

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3d04885-95a5-47cb-a038-b58542cf787d

SWB Exodus March 2019

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5ccc5c7-11ee-4357-8dd4-bf23ce2111bb

Lookout Uyghur Campaign

ATTACK:mobile:S0309 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e87aa0d6-241f-4f72-bdb6-54e8d5584ae2

NYTimes-BackDoor

ATTACK:mobile:S0539 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb052029-e1c9-4f24-8594-299aaec7f1df

Sophos Red Alert 2.0

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.