MITRE ATT&CKsub-technique

T1636.004 SMS Messages

Published 2022-04-01 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Collection
Platforms
Android, iOS
Version
1.1
Created
2022-04-01

Description

Adversaries may utilize standard operating system APIs to gather SMS messages. On Android, this can be accomplished using the SMS Content Provider. iOS provides no standard API to access SMS messages. If the device has been jailbroken or rooted, an adversary may be able to access SMS Messages without the user’s knowledge or approval.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1636 Protected User Data technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1011 User Guidance mitigation

Referenced by MITRE ATT&CK · uses (75)

  • S9006 VajraSpy software (malware)
  • S9005 DocSwap software (malware)
  • S9004 Crocodilus software (malware)
  • S1243 DCHSpy software (malware)
  • S1241 RatMilad software (malware)
  • S1231 GodFather software (malware)
  • C0054 Operation Triangulation campaign
  • S1214 Android/SpyAgent software (malware)
  • S1185 LightSpy software (malware)
  • S1128 HilalRAT software (malware)
  • C0033 C0033 campaign
  • S1126 Phenakite software (malware)
  • S1195 SpyC23 software (malware)
  • S1092 Escobar software (malware)
  • S1083 Chameleon software (malware)
  • S1079 BOULDSPY software (malware)
  • S1080 Fakecalls software (malware)
  • S1067 FluBot software (malware)
  • S1069 TangleBot software (malware)
  • S1061 AbstractEmu software (malware)
  • S1062 S.O.V.A. software (malware)
  • S1054 Drinik software (malware)
  • S1055 SharkBot software (malware)
  • C0016 Operation Dust Storm campaign
  • S0655 BusyGasper software (malware)
  • S0577 FrozenCell software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0549 SilkBean software (malware)
  • S0550 DoubleAgent software (malware)
  • S0551 GoldenEagle software (malware)
Show all 75 ›

References