Skip to content

Phishing

Technique · ATTACK:mobile:T1660

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1660",
  "title": "Phishing",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1660",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--defc1257-4db1-4fb3-8ef5-bb77f63146df",
  "external_id": "T1660",
  "domain": "mobile",
  "created": "2023-09-21T19:35:15.552Z",
  "modified": "2026-05-12T15:12:00.722Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "initial-access"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-9.html",
      "external_id": "AUT-9"
    }
  ]
}

Explicit source assertions (20)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0803b497-5064-4b7b-9db9-4e9c37b0b8c1

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09ad7d9f-d618-46c2-a9f3-e4a943245a72

ATTACK:mobile:G0094 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a71edbf-2fee-41e7-ade1-74abf165e5e2

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · FBI_KimsukyQR_Jan2026

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f35d6bf-c5e1-42bc-ba47-e06ee1a2e305

ThreatFabric_Chameleon_Dec2023

ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b04f772-62ef-4103-910f-f8eef8d1031a

CERTPL_NGate_Nov2025 · ESETStefanko_NGateVariant_Apr2026 · ESETStefankoOsmani_NGate_Aug2024

ATTACK:mobile:S1225 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3237f5ff-b870-41a7-8448-6f6b387db61d

TrendMicro_CherryBlos_July2023

ATTACK:mobile:G1015 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d5a1472-4042-49a4-8b66-7ff1fcfee92c

Mandiant UNC3944 May 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:mobile:G1002 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ec30b37-1db2-4048-9dd9-22d863f034bb

blackberry_mobile_malware_apt_esp

ATTACK:mobile:S0289 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b5baec3-60bf-4663-bc5c-ec9ad821c785

CitizenLab Great iPwn

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90e76d57-90b2-4d5d-8928-f6e6f5414bd4

FirshSecureList LightSpy 2020 · Shoshin_Kaspersky LightSpy 2020

ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91fa8232-f987-415b-8cb4-1ff3302a6c63

Europol FluBot Jun2022

ATTACK:mobile:G1029 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa468fe9-e580-41da-a888-100a799e8c6b

Meta Adversarial Threat Report 2022

ATTACK:mobile:G0034 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1abb6fd-04b4-4b0e-89f4-fd3f160ea3a6

Leonard TAG 2023

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5913e23-7fbc-4f46-b9a0-dbeafd4e693d

ESET_VajraSpy_Feb2024

ATTACK:mobile:G1028 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6adc765-20b4-48ef-ad5a-27fbd26c63c8

checkpoint_hamas_android_malware · sophos_android_apt_spyware

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8bfe893-49d8-4d6c-8f7d-5cd9fc932dee

securelist_brata_0819

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ccf741d0-9a3d-4b37-822e-a74267032279

MerkleScience_Godfather_April2023

ATTACK:mobile:M1058 → mitigates → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0669f8d-0aa2-416f-9ec4-a991a2000d3e

ATTACK:mobile:S1208 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d499cfc8-d5f8-4e05-ad82-a18d2823c558

Promon FjordPhantom Oct2024

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1660

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4c4da6c-54ad-4fbd-9944-e6b82a1bc4e0

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.