MITRE ATT&CKsub-technique

T1636.005 Accounts

Published 2025-09-17 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Collection
Platforms
Android, iOS
Version
1.0
Created
2025-09-17

Description

Adversaries may utilize standard operating system APIs to gather account data. On Android, this can be accomplished by using the AccountManager API. For example, adversaries may use the `getAccounts()` method to list all accounts. On iOS, this can be accomplished by using the Keychain services. If the device has been jailbroken or rooted, adversaries may be able to access Accounts without the users’ knowledge or approval.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1636 Protected User Data technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1011 User Guidance mitigation
  • M1006 Use Recent OS Version mitigation

Referenced by MITRE ATT&CK · uses (4)

  • S9006 VajraSpy software (malware)
  • S9005 DocSwap software (malware)
  • S1243 DCHSpy software (malware)
  • S1241 RatMilad software (malware)

References