aol.pm

Audio Capture

Technique · ATTACK:mobile:T1429

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1429",
  "title": "Audio Capture",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1429",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--6683aa0c-d98a-4f5b-ac57-ca7e9934a760",
  "external_id": "T1429",
  "domain": "mobile",
  "created": "2017-10-25T14:48:12.913Z",
  "modified": "2026-05-12T15:12:00.637Z",
  "version": "3.1",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "Manifest.permission",
      "url": "https://developer.android.com/reference/android/media/MediaRecorder.AudioSource#VOICE_CALL"
    },
    {
      "source_name": "Requesting Auth-Media Capture",
      "url": "https://developer.apple.com/documentation/avfoundation/cameras_and_media_capture/requesting_authorization_for_media_capture_on_ios"
    },
    {
      "source_name": "Android Permissions",
      "url": "https://developer.android.com/reference/android/Manifest.permission"
    },
    {
      "source_name": "Android Privacy Indicators",
      "url": "https://source.android.com/devices/tech/config/privacy-indicators"
    },
    {
      "source_name": "iOS Mic Spyware",
      "url": "https://blog.zecops.com/research/how-ios-malware-can-spy-on-users-silently/"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-19.html",
      "external_id": "APP-19"
    }
  ]
}

Explicit source assertions (56)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0327 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06348e22-9a06-4e4c-a57c-e438462e7fce

Kaspersky-Skygofree

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--066671b9-93d5-4309-8130-e01594b7c9d1

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S0316 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cae6859-d7d1-483b-b473-4f32084938a9

Lookout-PegasusAndroid

ATTACK:mobile:S0295 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14143e21-51bf-4fa7-a949-d22a8271f590

TrendMicro-RCSAndroid

ATTACK:mobile:S0507 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--146275c0-b6dd-4700-bded-bc361a67d023

Lookout eSurv

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b9b145c-ce80-4d0e-99f2-d756b806745b

lookout_bouldspy_0423

ATTACK:mobile:S0318 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22290cce-856a-46d5-9589-699f5dfc1429

TrendMicro-XLoader

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22755928-b0e1-4004-a89e-5f5ea2504cf8

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e826926-fd5b-407c-adbc-e998058728d3

CyberMerchants-FlexiSpy

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33857221-2543-4a7f-8255-b0d140d70ad7

Talos-WolfRAT

ATTACK:mobile:S0328 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3498d304-48e3-4fe4-a3ab-fc261104f413

Lookout-StealthMango

ATTACK:mobile:S0535 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36298fd6-d909-4490-8a04-095aef9ffafe

Symantec GoldenCup

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3752c235-0576-47dc-b05d-d3eaeaccfecc

Lookout Uyghur Campaign

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d5f7bdf-ab59-48f9-89d5-23f9d8cd235b

Zscaler TikTok Spyware

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e11a61b-14b3-4268-a6dd-937d4baef6de

lookout_hornbill_sunbird_0221

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3fcd2177-2030-4781-bd19-8b9fa8c6e645

BlackBerry Bahamut

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b06c7b6-f557-456a-8c03-0ed740713d29

K7Dhanalakshmi_VajraSpy_April2022 · ESET_VajraSpy_Feb2024

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f6f4def-e76d-4d1b-9416-b6543e7dbc54

SecureList BusyGasper

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61e27ee2-ef0a-43b9-8e58-e8703654bc25

MerkleScience_Godfather_April2023

ATTACK:mobile:S1080 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--642a2599-a50c-480c-8e07-2a3a217f4a46

kaspersky_fakecalls_0422

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--644a19d3-c94f-40d9-87ac-02ef20b14eda

lookout_abstractemu_1021

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--670a0995-a789-4674-9e91-c74316cdef90

Lookout Desert Scorpion

ATTACK:mobile:S1069 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6846dc09-b66a-42d3-aea2-c80b51f22952

cloudmark_tanglebot_0921

ATTACK:mobile:S0320 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69de3f7e-faa7-4342-b755-4777a68fd89b

Zscaler-SuperMarioRun

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d8ffc4a-6496-423e-a44d-d5a973ee1acf

Cyware APT-C-23 2020 · SentinelLabs AridViper 2023 · sophos_android_apt_spyware · threatpost AndroidSpyware 2020 · welivesecurity_apt-c-23

ATTACK:mobile:S1128 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70000e5a-cdff-4ff8-a565-5f7db60f8c49

Meta Adversarial Threat Report 2022

ATTACK:mobile:S1243 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76abec4d-469b-4f99-8c8d-625adca37702

Lookout_DCHSpy_July2025

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--797e82a0-0132-4adc-8885-c9e9d88386dd

welivesec_strongpity

ATTACK:mobile:S0182 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a50961b-9be4-4042-a6a0-878b612c520e

Lookout Dark Caracal Jan 2018

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b679dbf-4e31-4d0b-9e13-eb8c3b98b7fb

Android Capture Sensor 2019

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--841dcc87-1c22-4775-abe8-606aa6a48bf7

LinkedIn Dmitry LightSpy 2025 · FirshSecureList LightSpy 2020 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88ea5004-8bdb-4af4-a2dc-a8c56236ff03

Palo Alto HenBox

ATTACK:mobile:S1126 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89fcec02-8696-4c41-a7b1-8a75236a4c05

fb_arid_viper

ATTACK:mobile:S0425 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b66543e-2ea1-4ff7-84d9-f8f431f53781

TrendMicro Coronavirus Updates

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f88d438-3150-4317-b1fe-b14f13c15ac5

SWB Exodus March 2019

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--901492b5-b074-4631-ad6e-4178caa4164a

Lookout Uyghur Campaign

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a90aacf-3b03-4100-a600-5c455d4e48de

SecureList OpTriangulation 23Oct2023

ATTACK:mobile:S0329 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afc0f502-39bb-41e3-b4fc-5b5bb1a1175b

Lookout-StealthMango

ATTACK:mobile:S0292 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4180067-52b6-4109-91df-52fd9a7ed2e8

forcepoint_bitter · Lookout-EnterpriseApps

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4735277-516a-4cd2-9607-a3e415945d93

Lookout Uyghur Campaign

ATTACK:mobile:S0289 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7652f27-1cf6-4310-bf6b-5fb99c4fd725

Lookout-Pegasus

ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be07d829-9a12-4d90-ad8c-9e56782af120

welivesecurity_ahrat_0523

ATTACK:mobile:S0305 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf2ea132-c8f3-4ea0-8c4c-bdc95923c3b1

Zscaler-SpyNote

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce8cc50a-f3c9-4a6a-b6be-f3e8bdd293bd

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ced70cea-b2ac-45b8-9f7d-779eedbdf06c

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4a5a902-231e-4878-ad5b-39620498b018

Lookout-Monokle

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8ca4ea5-5242-4f0f-b3b7-008673f561ab

Lookout ViperRAT

ATTACK:mobile:S0577 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db1201f0-f925-4c3c-8673-7524a8c20886

Lookout FrozenCell

ATTACK:mobile:S0301 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e05b61a4-ba8a-4aa5-813b-ad76de5945a8

Lookout-Dendroid

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7af5be1-721f-40c5-b647-659243a0a14b

Cofense Anubis

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3c5d1a4-406d-47cc-8152-77bfbe5edaaf

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:S1092 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5acd046-2943-48bf-836a-2109c4f1a5c4

Bleeipng Computer Escobar

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f632b0bb-69ce-4678-bc3c-9ddff5a38794

SecureList - ViceLeaker 2019 · Bitdefender - Triout 2018

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6770c26-ae93-468d-acaa-ab4ffea0e047

PaloAlto-SpyDealer

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f84355c2-b829-4324-821a-b5148734bb6b

ATTACK:mobile:S0326 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffddcabb-0f03-46ae-abd6-7ab94e91b055

Wandera-RedDrop

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.