Skip to content

Accounts

Subtechnique · ATTACK:mobile:T1636.005

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1636.005",
  "title": "Accounts",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1636/005",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--337e1136-a6d3-4465-a5c5-fdc658117747",
  "external_id": "T1636.005",
  "domain": "mobile",
  "created": "2025-09-17T14:58:52.520Z",
  "modified": "2026-05-12T15:12:00.624Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "Android_AccountManager_Feb2025",
      "url": "https://developer.android.com/reference/android/accounts/AccountManager"
    }
  ]
}

Explicit source assertions (7)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1636.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03239f6a-a314-4ee0-81fa-006a39209b63

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:T1636.005 → subtechnique-of → ATTACK:mobile:T1636

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ac8d515-8b04-4502-b0fe-b8d7d9fc410a

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1636.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77740738-9796-4991-8898-dc2ba10c9c25

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1636.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99517b2d-0d51-4718-be20-5cafc55b35a5

K7Dhanalakshmi_VajraSpy_April2022

ATTACK:mobile:S1243 → uses → ATTACK:mobile:T1636.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d622d417-6439-40e8-ac3b-10463beeeb8f

Lookout_DCHSpy_July2025

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1636.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3340c35-81b3-497b-93e6-b59648ad2ccf

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1636.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcaf04f2-3944-44f9-898a-e3df3fcf30c7

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.