MITRE ATT&CKtechnique

T1512 Video Capture

Published 2019-08-09 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Collection
Platforms
Android, iOS
Version
2.1
Created
2019-08-09

Description

An adversary can leverage a device’s cameras to gather information by capturing video recordings. Images may also be captured, potentially in specified intervals, in lieu of video files. Malware or scripts may interact with the device cameras through an available API provided by the operating system. Video or image files may be written to disk and exfiltrated later. This technique differs from Screen Capture due to use of the device’s cameras for video recording rather than capturing the victim’s screen. In Android, an application must hold the `android.permission.CAMERA` permission to access the cameras. In iOS, applications must include the `NSCameraUsageDescription` key in the `Info.plist` file. In both cases, the user must grant permission to the requesting application to use the camera. If the device has been rooted or jailbroken, an adversary may be able to access the camera without knowledge of the user.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1006 Use Recent OS Version mitigation

Referenced by MITRE ATT&CK · uses (42)

  • S9006 VajraSpy software (malware)
  • S9005 DocSwap software (malware)
  • S9004 Crocodilus software (malware)
  • S1243 DCHSpy software (malware)
  • S1241 RatMilad software (malware)
  • S1185 LightSpy software (malware)
  • S1128 HilalRAT software (malware)
  • S1126 Phenakite software (malware)
  • S1195 SpyC23 software (malware)
  • S1092 Escobar software (malware)
  • S1082 Sunbird software (malware)
  • S1079 BOULDSPY software (malware)
  • S1080 Fakecalls software (malware)
  • S1077 Hornbill software (malware)
  • S1069 TangleBot software (malware)
  • S1061 AbstractEmu software (malware)
  • S0655 BusyGasper software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0549 SilkBean software (malware)
  • S0551 GoldenEagle software (malware)
  • S0544 HenBox software (malware)
  • S0535 Golden Cup software (malware)
  • S0505 Desert Scorpion software (malware)
  • S0506 ViperRAT software (malware)
  • S0489 WolfRAT software (malware)
  • G0112 Windshift group
  • S0425 Corona Updates software (malware)
  • S0426 Concipit1248 software (malware)
  • S0421 GolfSpy software (malware)
  • S0418 ViceLeaker software (malware)
Show all 42 ›

References