GUI Input Capture
Subtechnique · ATTACK:mobile:T1417.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:T1417.002",
"title": "GUI Input Capture",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1417/002",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--4c58b7c6-a839-4789-bda9-9de33e4d4512",
"external_id": "T1417.002",
"domain": "mobile",
"created": "2022-04-05T19:48:31.195Z",
"modified": "2026-05-12T15:12:00.630Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"credential-access",
"collection"
],
"source_references": [
{
"source_name": "Felt-PhishingOnMobileDevices",
"url": "http://w2spconf.com/2011/papers/felt-mobilephishing.pdf"
},
{
"source_name": "Android Background",
"url": "https://developer.android.com/guide/components/activities/background-starts"
},
{
"source_name": "Cloak and Dagger",
"url": "https://cloak-and-dagger.org/"
},
{
"source_name": "Group IB Gustuff Mar 2019",
"url": "https://www.group-ib.com/blog/gustuff"
},
{
"source_name": "eset-finance",
"url": "https://www.welivesecurity.com/2018/09/19/fake-finance-apps-google-play-target-around-world/"
},
{
"source_name": "Hassell-ExploitingAndroid",
"url": "https://conference.hitb.org/hitbsecconf2011kul/materials/D1T1%20-%20Riley%20Hassell%20-%20Exploiting%20Androids%20for%20Fun%20and%20Profit.pdf"
},
{
"source_name": "XDA Bubbles",
"url": "https://www.xda-developers.com/android-q-system-alert-window-deprecate-bubbles/"
},
{
"source_name": "NowSecure Android Overlay",
"url": "https://www.nowsecure.com/blog/2017/05/25/android-overlay-malware-system-alert-window-permission/"
},
{
"source_name": "ThreatFabric Cerberus",
"url": "https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld.html"
},
{
"source_name": "Skycure-Accessibility",
"url": "https://web.archive.org/web/20170211204349/https://www.skycure.com/blog/accessibility-clickjacking/"
},
{
"source_name": "NIST Mobile Threat Catalogue",
"url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-31.html",
"external_id": "APP-31"
}
]
}Explicit source assertions (33)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0efe4125-504f-4eea-b19f-a44c81ee31dd
Zscaler TikTok SpywareATTACK:mobile:S1062 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--127e6672-d16a-4370-b277-4d04874a4cfe
threatfabric_sova_0921ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12d61e7d-7fa6-422d-9817-901decf6b650
Lookout Dark Caracal Jan 2018ATTACK:mobile:S0297 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13efc415-5e17-4a16-81c2-64e74815907f
PaloAlto-XcodeGhostATTACK:mobile:S0298 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cca5e17-80ae-4b6e-8919-2768153aa966
PaloAlto-XbotATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f44936e-b84c-404f-a92e-6fb7e24b5435
Android 12 FeaturesATTACK:mobile:S0545 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--212801c2-5d14-4381-b25a-340cda11a5ac
WhiteOps TERRACOTTAATTACK:mobile:S1056 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2caddf52-2bc2-4f75-90bb-0f292952ada6
trendmicro_tianyspy_0122ATTACK:mobile:S0478 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fd2785f-f0eb-4aa9-8a10-e1c9a88b372a
Cybereason EventBotATTACK:mobile:S0301 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--455b1287-5784-42b4-91fb-01dac007758d
Lookout-DendroidATTACK:mobile:S0539 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45da5ed9-3a9b-4491-98cb-96db68e245bb
Sophos Red Alert 2.0ATTACK:mobile:T1417.002 → subtechnique-of → ATTACK:mobile:T1417
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--465b7a4a-32d5-475c-9fb9-6335c44fb0d1
ATTACK:mobile:S1069 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ff9b16f-3643-4fa0-b107-f93a9bb847c3
cloudmark_tanglebot_0921ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60e2ebd0-90dc-4131-ba4f-adc9b49ec113
Threat Fabric CerberusATTACK:mobile:S1083 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65dc7cc1-e047-4087-8b2b-7d0d0f67576a
cyble_chameleon_0423 · ThreatFabric_Chameleon_Dec2023ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67aa692c-24e4-483e-996e-02ce1e861ec8
proofpoint_flubot_0421ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6faacfdd-d17d-4c6e-a33e-5fdea2cc3998
Cofense AnubisATTACK:mobile:S0423 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74c3c88c-956b-4bc7-9ea2-585e7366fe69
ThreatFabric GinpATTACK:mobile:S1054 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--848581bc-bf8f-40e2-871e-cd67042b4adf
cyble_drinik_1022ATTACK:mobile:S0403 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93395e61-0d3e-4ea6-9c1b-08d4a04005a0
Kaspersky Riltok June 2019ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2365c91-60f6-4249-af13-6bc2fdb80d52
securelist rotexy 2018ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa1deed1-800c-470b-ac88-eb8013c11ec0
Group IB Gustuff Mar 2019 · Talos Gustuff Apr 2019ATTACK:mobile:S1055 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afc0e8b2-2e85-4640-8517-fb2e16831082
nccgroup_sharkbot_0322ATTACK:mobile:S1093 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b96e8699-4bd2-4793-8f9c-88d6e4c50e98
Trend Micro FlyTrapATTACK:mobile:S0485 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb34aff0-9af9-463b-a1aa-7f5ec7b84630
Bitdefender MandrakeATTACK:mobile:S1094 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1cafa91-9891-4e65-b75d-d83ef6838653
cleafy_brata_0122ATTACK:mobile:S1103 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cce49043-52b0-407c-b4f0-0f4727351d4b
checkpoint_flixonline_0421ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cee9ebfe-9558-4b07-8a2e-de4c57ea6068
ESETStefankoOsmani_NGate_Aug2024ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d724bcf3-25d2-406a-b612-333fea5e2385
Threat Fabric ExobotATTACK:mobile:M1012 → mitigates → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f051c943-998c-4db2-9dbc-d4755057bcf0
ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f28a2873-281f-405b-bad0-4a93dac8a5ee
Talos GPlayedATTACK:mobile:S1092 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbeef07b-7aa1-461c-884a-d3c4f730d5f7
Bleeipng Computer EscobarATTACK:mobile:S9004 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc8d747d-d6d0-4599-955b-325d8489e84c
ThreatFabric_Crocodilus_June2025