Transmitted Data Manipulation

Subtechnique · ATTACK:mobile:T1641.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1641.001",
  "title": "Transmitted Data Manipulation",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1641/001",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--74e6003f-c7f4-4047-983b-708cc19b96b6",
  "external_id": "T1641.001",
  "domain": "mobile",
  "created": "2022-04-06T13:39:39.779Z",
  "modified": "2025-10-24T17:48:57.794Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "impact"
  ],
  "source_references": [
    {
      "source_name": "ESET Clipboard Modification February 2019",
      "url": "https://www.eset.com/uk/about/newsroom/press-releases/first-clipper-malware-discovered-on-google-play-1/"
    }
  ]
}

Explicit source assertions (4)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1641.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18a6020d-8fea-4a6e-84ab-a18343f2acea

Android 10 Privacy Changes

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1641.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5749763a-0aef-460a-b081-849adba8d58f

mcafee_brata_0421

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1641.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7965128c-89d6-411e-b765-c60e0cae96c6

threatfabric_sova_0921

ATTACK:mobile:T1641.001 → subtechnique-of → ATTACK:mobile:T1641

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86afe8cc-6d6d-4952-8fee-619e95d53a7f

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.