MITRE ATT&CKsub-technique

T1636.003 Contact List

Published 2022-04-01 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Collection
Platforms
Android, iOS
Version
1.1
Created
2022-04-01

Description

Adversaries may utilize standard operating system APIs to gather contact list data. On Android, this can be accomplished using the Contacts Content Provider. On iOS, this can be accomplished using the `Contacts` framework. If the device has been jailbroken or rooted, an adversary may be able to access the Contact List without the user’s knowledge or approval.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1636 Protected User Data technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1011 User Guidance mitigation

Referenced by MITRE ATT&CK · uses (58)

  • S9006 VajraSpy software (malware)
  • S9005 DocSwap software (malware)
  • S9004 Crocodilus software (malware)
  • S1243 DCHSpy software (malware)
  • S1241 RatMilad software (malware)
  • S1231 GodFather software (malware)
  • S1185 LightSpy software (malware)
  • S1128 HilalRAT software (malware)
  • C0033 C0033 campaign
  • S1126 Phenakite software (malware)
  • S1195 SpyC23 software (malware)
  • S1095 AhRat software (malware)
  • S1082 Sunbird software (malware)
  • S1079 BOULDSPY software (malware)
  • S1080 Fakecalls software (malware)
  • S1077 Hornbill software (malware)
  • S1067 FluBot software (malware)
  • S1069 TangleBot software (malware)
  • S1061 AbstractEmu software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0549 SilkBean software (malware)
  • S0550 DoubleAgent software (malware)
  • S0551 GoldenEagle software (malware)
  • S0544 HenBox software (malware)
  • S0539 Red Alert 2.0 software (malware)
  • S0540 Asacub software (malware)
  • S0536 GPlayed software (malware)
  • S0535 Golden Cup software (malware)
  • S0522 Exobot software (malware)
  • S0509 FakeSpy software (malware)
Show all 58 ›

References