MITRE ATT&CKtechnique

T1417 Input Capture

Published 2017-10-25 Modified 2025-10-24 Official page ↗

Domain: mobile
Tactics: Collection, Credential Access
Platforms: Android, iOS
Version: 2.3
Created: 2017-10-25

Description

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal device usage, users often provide credentials to various locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Keylogging) or rely on deceiving the user into providing input into what they believe to be a genuine application prompt (e.g. GUI Input Capture).

Tactic · MITRE ATT&CK (2)

TA0031 Credential Access tactic
TA0035 Collection tactic

Referenced by MITRE ATT&CK · mitigates (3)

M1011 User Guidance mitigation
M1006 Use Recent OS Version mitigation
M1012 Enterprise Policy mitigation

Referenced by MITRE ATT&CK · subtechnique of (2)

T1417.001 Keylogging sub-technique
T1417.002 GUI Input Capture sub-technique

Referenced by MITRE ATT&CK · uses (3)

S1231 GodFather software (malware)
S1225 CherryBlos software (malware)
S1126 Phenakite software (malware)

References

https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-31.html NIST Mobile Threat Catalogue
https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-13.html NIST Mobile Threat Catalogue