MITRE ATT&CKsub-technique

T1417.002 GUI Input Capture

Published 2022-04-05 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Credential Access, Collection
Platforms
Android, iOS
Version
1.1
Created
2022-04-05

Description

Adversaries may mimic common operating system GUI components to prompt users for sensitive information with a seemingly legitimate prompt. The operating system and installed applications often have legitimate needs to prompt the user for sensitive information such as account credentials, bank account information, or Personally Identifiable Information (PII). Compared to traditional PCs, the constrained display size of mobile devices may impair the ability to provide users with contextual information, making users more susceptible to this technique’s use. There are several approaches adversaries may use to mimic this functionality. Adversaries may impersonate the identity of a legitimate application (e.g. use the same application name and/or icon) and, when installed on the device, may prompt the user for sensitive information. Adversaries may also send fake device notifications to the user that may trigger the display of an input prompt when clicked. Additionally, adversaries may display a prompt on top of a running, legitimate application to trick users into entering sensitive information into a malicious application rather than the legitimate application. Typically, adversaries need to know when the targeted application and the individual activity within the targeted application is running in the foreground to display the prompt at the proper time. Adversaries can abuse Android’s accessibility features to determine which application is currently in the foreground. Two known approaches to displaying a prompt include: • Adversaries start a new activity on top of a running legitimate application. Android 10 places new restrictions on the ability for an application to start a new activity on top of another application, which may make it more difficult for adversaries to utilize this technique. • Adversaries create an application overlay window on top of a running legitimate application. Applications must hold the `SYSTEM_ALERT_WINDOW` permission to create overlay windows. This permission is handled differently than typical Android permissions and, at least under certain conditions, is automatically granted to applications installed from the Google Play Store. The `SYSTEM_ALERT_WINDOW` permission and its associated ability to create application overlay windows are expected to be deprecated in a future release of Android in favor of a new API.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1417 Input Capture technique

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1006 Use Recent OS Version mitigation
  • M1012 Enterprise Policy mitigation

Referenced by MITRE ATT&CK · uses (30)

  • S9040 NGate software (malware)
  • S9004 Crocodilus software (malware)
  • S1103 FlixOnline software (malware)
  • S1094 BRATA software (malware)
  • S1092 Escobar software (malware)
  • S1093 FlyTrap software (malware)
  • S1083 Chameleon software (malware)
  • S1067 FluBot software (malware)
  • S1069 TangleBot software (malware)
  • S1062 S.O.V.A. software (malware)
  • S1056 TianySpy software (malware)
  • S1054 Drinik software (malware)
  • S1055 SharkBot software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0545 TERRACOTTA software (malware)
  • S0539 Red Alert 2.0 software (malware)
  • S0536 GPlayed software (malware)
  • S0522 Exobot software (malware)
  • S0485 Mandrake software (malware)
  • S0478 EventBot software (malware)
  • S0480 Cerberus software (malware)
  • S0422 Anubis software (malware)
  • S0423 Ginp software (malware)
  • S0411 Rotexy software (malware)
  • S0406 Gustuff software (malware)
  • S0403 Riltok software (malware)
  • S0399 Pallas software (malware)
  • S0297 XcodeGhost software (malware)
  • S0298 Xbot software (tool)
  • S0301 Dendroid software (malware)

References