Input Injection
Technique · ATTACK:mobile:T1516
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:T1516",
"title": "Input Injection",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1516",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--d1f1337e-aea7-454c-86bd-482a98ffaf62",
"external_id": "T1516",
"domain": "mobile",
"created": "2019-09-15T15:26:22.356Z",
"modified": "2026-05-12T15:12:00.717Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"defense-evasion",
"impact"
],
"source_references": [
{
"source_name": "bitwarden autofill logins",
"url": "https://help.bitwarden.com/article/auto-fill-android/"
},
{
"source_name": "android-trojan-steals-paypal-2fa",
"url": "https://www.welivesecurity.com/2018/12/11/android-trojan-steals-money-paypal-accounts-2fa/"
},
{
"source_name": "Talos Gustuff Apr 2019",
"url": "https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b1f2735-97d9-4f4a-9967-9fa1464bb651
cleafy_sova_1122ATTACK:mobile:S0479 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1577a79c-5f70-41cc-95bd-2407cfd1acbd
ESET DEFENSOR IDATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17558571-7352-470b-b728-0511fb3f699d
ATTACK:mobile:M1012 → mitigates → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3dff770d-9627-4647-b945-7f24a97b2273
ATTACK:mobile:S0423 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43a62244-29f1-4f7f-bc9f-9b7b8e488b38
ThreatFabric GinpATTACK:mobile:S0545 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4761145d-34ac-4b45-a0d6-a09b1907a196
WhiteOps TERRACOTTAATTACK:mobile:S1055 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5dc4eaca-ff82-412a-a8dd-168de1857d8c
nccgroup_sharkbot_0322ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--740ea19e-d248-44e5-a0e5-3e9420df9dc8
SecurityIntelligence TrickMoATTACK:mobile:S1094 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4e72b4f-7ee4-4ee3-82c9-acc3aedb1f2d
mcafee_brata_0421 · securelist_brata_0819ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a67a9c6f-318a-4ca5-aa6a-1d6d88b5d523
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af55d12a-5f58-4135-90d0-f465a66f7a3f
Bitdefender MandrakeATTACK:mobile:S0494 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afe9e326-01f7-4296-a11b-09cfffd80120
Google Security ZenATTACK:mobile:S1231 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0121974-44ba-425d-9445-2d6598a5bc66
ZimperiumOrtegaPratapagiri_GodFather_Jun2025ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cacc0b72-9d73-4381-90e9-545ba908722c
Talos Gustuff Apr 2019ATTACK:mobile:S0403 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9607e4f-5743-4bbb-b7d4-5554d66c8be7
Kaspersky Riltok June 2019ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f776a4da-0fa6-414c-a705-e9e8b419e056
Threat Fabric Cerberus · CheckPoint Cerberus