{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1429","id":"T1429","name":"Audio Capture","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1429","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"dff48897a8c050b759a99ad7c1e9de6e6183d3686726d2f4224cd537a44338f0","description":"Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information. \n\n \n\nAndroid and iOS, by default, require that applications request device microphone access from the user.  \n\n \n\nOn Android devices, applications must hold the `RECORD_AUDIO` permission to access the microphone or the `CAPTURE_AUDIO_OUTPUT` permission to access audio output. Because Android does not allow third-party applications to hold the `CAPTURE_AUDIO_OUTPUT` permission by default, only privileged applications, such as those distributed by Google or the device vendor, can access audio output.(Citation: Android Permissions) However, adversaries may be able to gain this access after successfully elevating their privileges. With the `CAPTURE_AUDIO_OUTPUT` permission, adversaries may pass the `MediaRecorder.AudioSource.VOICE_CALL` constant to `MediaRecorder.setAudioOutput`, allowing capture of both voice call uplink and downlink.(Citation: Manifest.permission) \n\n \n\nOn iOS devices, applications must include the `NSMicrophoneUsageDescription` key in their `Info.plist` file to access the microphone.(Citation: Requesting Auth-Media Capture)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1429","external_id":"T1429"},{"source_name":"Manifest.permission","description":"Android Developers. (2022, March 17). Voice Call. Retrieved April 1, 2022.","url":"https://developer.android.com/reference/android/media/MediaRecorder.AudioSource#VOICE_CALL"},{"source_name":"Requesting Auth-Media Capture","description":"Apple Developers. (n.d.). Requesting Authorization for Media Capture on iOS. Retrieved April 1, 2022.","url":"https://developer.apple.com/documentation/avfoundation/cameras_and_media_capture/requesting_authorization_for_media_capture_on_ios"},{"source_name":"Android Permissions","description":"Google. (2021, August 11). Manifest.permission. Retrieved September 22, 2021.","url":"https://developer.android.com/reference/android/Manifest.permission"},{"source_name":"Android Privacy Indicators","description":"Google. (n.d.). Privacy Indicators. Retrieved April 20, 2022.","url":"https://source.android.com/devices/tech/config/privacy-indicators"},{"source_name":"iOS Mic Spyware","description":"ZecOps Research Team. (2021, November 4). How iOS Malware Can Spy on Users Silently. Retrieved April 1, 2022.","url":"https://blog.zecops.com/research/how-ios-malware-can-spy-on-users-silently/"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-19.html","external_id":"APP-19"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0112","name":"API Calls","page":"telemetry/DC0112/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Instrumented mobile API calls and results relevant to an application behavior.","collection_focus":"Instrument selected APIs in the owned test app or approved research build; log caller, API, sanitized argument class and return status.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","api","result","thread"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0112","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","api":"android.hardware.camera2.CameraManager.openCamera","result":"permission_denied","thread":"main"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0114","name":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Declared or granted permissions of a mobile application.","collection_focus":"Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":{"label":"Inspect the owned Android lab application","language":"shell","source_id":"android_state","content":"adb shell dumpsys package test.example.lab","note":"Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream."},"required_fields":["package","permission","declared","granted"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0116","name":"Permissions Request","page":"telemetry/DC0116/","kind":"attack_component","category":"Mobile lab instrumentation","description":"A system prompt for an application permission, with request and response context where observable.","collection_focus":"Correlate own-app request/callback instrumentation with the consented test-device prompt. A request callback alone does not prove a prompt appeared (for example, a previously denied permission).","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","permission","action","prompt_observed","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0116","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","action":"permission_prompt","prompt_observed":true,"result":"denied"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."}],"detection":{"key":"mobile/T1429","id":"T1429","name":"Audio Capture","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1429","technique_page":"techniques/mobile/T1429/","page":"detections/mobile/T1429/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0673","name":"Detection of Audio Capture","url":"https://attack.mitre.org/detectionstrategies/DET0673","stix_id":"x-mitre-detection-strategy--3e6673dc-e2c7-440e-b632-d25e3e9f92cc","relationship_id":"relationship--b0a5a5e8-3815-48eb-bceb-d24ca84417b5","description":"","analytics":[{"id":"AN1772","name":"Analytic 1772","guidance":"For Android, detect Audio Capture by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: AudioRecord.startRecording() or MediaRecorder.start() called by app NOT IN $AudioAllowList$]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for file with audio MIME type (audio/mp4, audio/aac, audio/3gpp) in /data/data//files/ within $AudioCaptureWindow$ of recording API start]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0673#AN1772","platforms":["Android"],"tuning":[{"field":"AudioAllowList","description":"VoIP, voice memo, approved call recorder apps. Derive from MDM catalog."},{"field":"AudioCaptureWindow","description":"Default 60s between recording start and file write."},{"field":"AudioUplinkThreshold","description":"Default 50KB — ~10s of audio at typical mobile codec rate."},{"field":"AppCDNList","description":"Per-app CDN. Derive by measurement."},{"field":"ExfilWindow","description":"Default 120s."}],"log_sources":[{"component_id":"DC0112","component":"API Calls","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: AudioRecord.startRecording() or MediaRecorder.start() called by app NOT IN $AudioAllowList$","platforms":["Android"],"analytic_id":"AN1772","source_url":"https://attack.mitre.org/detectionstrategies/DET0673#AN1772","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0112/"},{"component_id":"DC0039","component":"File Creation","name":"mobile:ForensicArtifacts","channel":"Dynamic filesystem trace or acquired app-container/filesystem artifacts: open() with O_CREAT for file with audio MIME type (audio/mp4, audio/aac, audio/3gpp) in /data/data/<app>/files/ within $AudioCaptureWindow$ of recording API start","platforms":["Android"],"analytic_id":"AN1772","source_url":"https://attack.mitre.org/detectionstrategies/DET0673#AN1772","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"android:EnterpriseNetworkLog","channel":"DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata","platforms":["Android"],"analytic_id":"AN1772","source_url":"https://attack.mitre.org/detectionstrategies/DET0673#AN1772","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0116","component":"Permissions Request","name":"android:DevicePolicyManager","channel":"DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review","platforms":["Android"],"analytic_id":"AN1772","source_url":"https://attack.mitre.org/detectionstrategies/DET0673#AN1772","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0116/"}]},{"id":"AN1773","name":"Analytic 1773","guidance":"For iOS, detect Audio Capture by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0673#AN1773","platforms":["iOS"],"tuning":[{"field":"AudioAllowList","description":"VoIP, voice memo, approved recording app bundle IDs. Derive from MDM catalog."},{"field":"AudioUplinkThreshold","description":"Default 50KB — ~10 seconds of audio at typical mobile codec."},{"field":"AppCDNList","description":"Per-app CDN baseline."}],"log_sources":[{"component_id":"DC0114","component":"Application Permission","name":"mobile:ApplicationVetting","channel":"Code-signing entitlements and Info.plist privacy usage-description keys","platforms":["iOS"],"analytic_id":"AN1773","source_url":"https://attack.mitre.org/detectionstrategies/DET0673#AN1773","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0114/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"iOS:NetworkExtension","channel":"NEFilterFlow / per-app VPN / secure-web-gateway flow metadata","platforms":["iOS"],"analytic_id":"AN1773","source_url":"https://attack.mitre.org/detectionstrategies/DET0673#AN1773","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0116","component":"Permissions Request","name":"mobile:ApplicationVetting","channel":"Code-signing entitlements and Info.plist privacy usage-description keys","platforms":["iOS"],"analytic_id":"AN1773","source_url":"https://attack.mitre.org/detectionstrategies/DET0673#AN1773","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0116/"}]}]}],"telemetry_references":[{"id":"DC0112","name":"API Calls","tag":"API Calls","page":"telemetry/DC0112/","kind":"attack_component"},{"id":"DC0114","name":"Application Permission","tag":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0116","name":"Permissions Request","tag":"Permissions Request","page":"telemetry/DC0116/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0408","name":"FlexiSpy","page":"tools/S0408/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0408","name":"FlexiSpy","page":"tools/S0408/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0182","name":"FinFisher","url":"https://attack.mitre.org/software/S0182","kind":"malware","description":"[FinFisher](https://attack.mitre.org/software/S0182) uses the device microphone to record phone conversations.(Citation: Lookout Dark Caracal Jan 2018)","relationship_id":"relationship--7a50961b-9be4-4042-a6a0-878b612c520e","references":[{"source_name":"Lookout Dark Caracal Jan 2018","description":"Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"id":"S0289","name":"Pegasus for iOS","url":"https://attack.mitre.org/software/S0289","kind":"malware","description":"[Pegasus for iOS](https://attack.mitre.org/software/S0289) has the ability to record audio.(Citation: Lookout-Pegasus)","relationship_id":"relationship--b7652f27-1cf6-4310-bf6b-5fb99c4fd725","references":[{"source_name":"Lookout-Pegasus","description":"Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.","url":"https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf"}]},{"id":"S0292","name":"AndroRAT","url":"https://attack.mitre.org/software/S0292","kind":"malware","description":"[AndroRAT](https://attack.mitre.org/software/S0292) gathers audio from the microphone.(Citation: Lookout-EnterpriseApps)(Citation: forcepoint_bitter) ","relationship_id":"relationship--b4180067-52b6-4109-91df-52fd9a7ed2e8","references":[{"source_name":"forcepoint_bitter","description":"Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved March 1, 2024.","url":"https://web.archive.org/web/20220706125432/https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"},{"source_name":"Lookout-EnterpriseApps","description":"Lookout. (2016, May 25). 5 active mobile threats spoofing enterprise apps. Retrieved December 19, 2016.","url":"https://blog.lookout.com/blog/2016/05/25/spoofed-apps/"}]},{"id":"S0295","name":"RCSAndroid","url":"https://attack.mitre.org/software/S0295","kind":"malware","description":"[RCSAndroid](https://attack.mitre.org/software/S0295) can record audio using the device microphone.(Citation: TrendMicro-RCSAndroid)","relationship_id":"relationship--14143e21-51bf-4fa7-a949-d22a8271f590","references":[{"source_name":"TrendMicro-RCSAndroid","description":"Veo Zhang. (2015, July 21). Hacking Team RCSAndroid Spying Tool Listens to Calls; Roots Devices to Get In. Retrieved December 22, 2016.","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-rcsandroid-spying-tool-listens-to-calls-roots-devices-to-get-in/"}]},{"id":"S0301","name":"Dendroid","url":"https://attack.mitre.org/software/S0301","kind":"malware","description":"[Dendroid](https://attack.mitre.org/software/S0301) can record audio and outgoing calls.(Citation: Lookout-Dendroid)","relationship_id":"relationship--e05b61a4-ba8a-4aa5-813b-ad76de5945a8","references":[{"source_name":"Lookout-Dendroid","description":"Marc Rogers. (2014, March 6). Dendroid malware can take over your camera, record audio, and sneak into Google Play. Retrieved December 22, 2016.","url":"https://blog.lookout.com/blog/2014/03/06/dendroid/"}]},{"id":"S0305","name":"SpyNote RAT","url":"https://attack.mitre.org/software/S0305","kind":"malware","description":"[SpyNote RAT](https://attack.mitre.org/software/S0305) can activate the victim's microphone.(Citation: Zscaler-SpyNote)","relationship_id":"relationship--bf2ea132-c8f3-4ea0-8c4c-bdc95923c3b1","references":[{"source_name":"Zscaler-SpyNote","description":"Shivang Desai. (2017, January 23). SpyNote RAT posing as Netflix app. Retrieved January 26, 2017.","url":"https://www.zscaler.com/blogs/research/spynote-rat-posing-netflix-app"}]},{"id":"S0316","name":"Pegasus for Android","url":"https://attack.mitre.org/software/S0316","kind":"malware","description":"[Pegasus for Android](https://attack.mitre.org/software/S0316) has the ability to record device audio.(Citation: Lookout-PegasusAndroid)","relationship_id":"relationship--0cae6859-d7d1-483b-b473-4f32084938a9","references":[{"source_name":"Lookout-PegasusAndroid","description":"Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017.","url":"https://blog.lookout.com/blog/2017/04/03/pegasus-android/"}]},{"id":"S0318","name":"XLoader for Android","url":"https://attack.mitre.org/software/S0318","kind":"malware","description":"[XLoader for Android](https://attack.mitre.org/software/S0318) covertly records phone calls.(Citation: TrendMicro-XLoader)","relationship_id":"relationship--22290cce-856a-46d5-9589-699f5dfc1429","references":[{"source_name":"TrendMicro-XLoader","description":"Lorin Wu. (2018, April 19). XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing. Retrieved July 6, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/xloader-android-spyware-and-banking-trojan-distributed-via-dns-spoofing/"}]},{"id":"S0320","name":"DroidJack","url":"https://attack.mitre.org/software/S0320","kind":"malware","description":"[DroidJack](https://attack.mitre.org/software/S0320) is capable of recording device phone calls.(Citation: Zscaler-SuperMarioRun)","relationship_id":"relationship--69de3f7e-faa7-4342-b755-4777a68fd89b","references":[{"source_name":"Zscaler-SuperMarioRun","description":"Viral Gandhi. (2017, January 12). Super Mario Run Malware #2 – DroidJack RAT. Retrieved January 20, 2017.","url":"https://www.zscaler.com/blogs/security-research/super-mario-run-malware-2-droidjack-rat"}]},{"id":"S0324","name":"SpyDealer","url":"https://attack.mitre.org/software/S0324","kind":"malware","description":"[SpyDealer](https://attack.mitre.org/software/S0324) can record phone calls and surrounding audio.(Citation: PaloAlto-SpyDealer)","relationship_id":"relationship--f6770c26-ae93-468d-acaa-ab4ffea0e047","references":[{"source_name":"PaloAlto-SpyDealer","description":"Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/07/unit42-spydealer-android-trojan-spying-40-apps/"}]},{"id":"S0326","name":"RedDrop","url":"https://attack.mitre.org/software/S0326","kind":"malware","description":"[RedDrop](https://attack.mitre.org/software/S0326) captures live recordings of the device's surroundings.(Citation: Wandera-RedDrop)","relationship_id":"relationship--ffddcabb-0f03-46ae-abd6-7ab94e91b055","references":[{"source_name":"Wandera-RedDrop","description":"Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20180618225805/https://www.wandera.com/reddrop-malware/"}]},{"id":"S0327","name":"Skygofree","url":"https://attack.mitre.org/software/S0327","kind":"malware","description":"[Skygofree](https://attack.mitre.org/software/S0327) can record audio via the microphone when an infected device is in a specified location.(Citation: Kaspersky-Skygofree)","relationship_id":"relationship--06348e22-9a06-4e4c-a57c-e438462e7fce","references":[{"source_name":"Kaspersky-Skygofree","description":"Nikita Buchka and Alexey Firsh. (2018, January 16). Skygofree: Following in the footsteps of HackingTeam. Retrieved September 24, 2018.","url":"https://securelist.com/skygofree-following-in-the-footsteps-of-hackingteam/83603/"}]},{"id":"S0328","name":"Stealth Mango","url":"https://attack.mitre.org/software/S0328","kind":"malware","description":"[Stealth Mango](https://attack.mitre.org/software/S0328) can record audio using the device microphone.(Citation: Lookout-StealthMango)","relationship_id":"relationship--3498d304-48e3-4fe4-a3ab-fc261104f413","references":[{"source_name":"Lookout-StealthMango","description":"Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/lookout-stealth-mango-srr-us.pdf"}]},{"id":"S0329","name":"Tangelo","url":"https://attack.mitre.org/software/S0329","kind":"malware","description":"[Tangelo](https://attack.mitre.org/software/S0329) contains functionality to record calls as well as the victim device's environment.(Citation: Lookout-StealthMango)","relationship_id":"relationship--afc0f502-39bb-41e3-b4fc-5b5bb1a1175b","references":[{"source_name":"Lookout-StealthMango","description":"Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/lookout-stealth-mango-srr-us.pdf"}]},{"id":"S0399","name":"Pallas","url":"https://attack.mitre.org/software/S0399","kind":"malware","description":"[Pallas](https://attack.mitre.org/software/S0399) captures audio from the device microphone.(Citation: Lookout Dark Caracal Jan 2018)","relationship_id":"relationship--ce8cc50a-f3c9-4a6a-b6be-f3e8bdd293bd","references":[{"source_name":"Lookout Dark Caracal Jan 2018","description":"Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"id":"S0405","name":"Exodus","url":"https://attack.mitre.org/software/S0405","kind":"malware","description":" [Exodus](https://attack.mitre.org/software/S0405) Two can record audio from the compromised device's microphone and can record call audio in 3GP format.(Citation: SWB Exodus March 2019) ","relationship_id":"relationship--8f88d438-3150-4317-b1fe-b14f13c15ac5","references":[{"source_name":"SWB Exodus March 2019","description":"Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20200314194610/https://securitywithoutborders.org/blog/2019/03/29/exodus.html"}]},{"id":"S0407","name":"Monokle","url":"https://attack.mitre.org/software/S0407","kind":"malware","description":"[Monokle](https://attack.mitre.org/software/S0407) can record audio from the device's microphone and can record phone calls, specifying the output audio quality.(Citation: Lookout-Monokle)","relationship_id":"relationship--d4a5a902-231e-4878-ad5b-39620498b018","references":[{"source_name":"Lookout-Monokle","description":"Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.","url":"https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf"}]},{"id":"S0408","name":"FlexiSpy","url":"https://attack.mitre.org/software/S0408","kind":"tool","description":"[FlexiSpy](https://attack.mitre.org/software/S0408) can record both incoming and outgoing phone calls, as well as microphone audio.(Citation: CyberMerchants-FlexiSpy)","relationship_id":"relationship--2e826926-fd5b-407c-adbc-e998058728d3","references":[{"source_name":"CyberMerchants-FlexiSpy","description":"Actis B. (2017, April 22). FlexSpy Application Analysis. Retrieved September 4, 2019.","url":"http://www.cybermerchantsofdeath.com/blog/2017/04/22/FlexiSpy.html"}]},{"id":"S0418","name":"ViceLeaker","url":"https://attack.mitre.org/software/S0418","kind":"malware","description":"[ViceLeaker](https://attack.mitre.org/software/S0418) can record audio from the device’s microphone and can record phone calls together with the caller ID.(Citation: SecureList - ViceLeaker 2019)(Citation: Bitdefender - Triout 2018)","relationship_id":"relationship--f632b0bb-69ce-4678-bc3c-9ddff5a38794","references":[{"source_name":"SecureList - ViceLeaker 2019","description":"GReAT. (2019, June 26).  ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.","url":"https://securelist.com/fanning-the-flames-viceleaker-operation/90877/"},{"source_name":"Bitdefender - Triout 2018","description":"L. Arsene, C. Ochinca. (2018, August 20). Triout – Spyware Framework for Android with Extensive Surveillance Capabilities. Retrieved January 21, 2020.","url":"https://labs.bitdefender.com/2018/08/triout-spyware-framework-for-android-with-extensive-surveillance-capabilities/"}]},{"id":"S0421","name":"GolfSpy","url":"https://attack.mitre.org/software/S0421","kind":"malware","description":"[GolfSpy](https://attack.mitre.org/software/S0421) can record audio and phone calls.(Citation: Trend Micro Bouncing Golf 2019)","relationship_id":"relationship--ced70cea-b2ac-45b8-9f7d-779eedbdf06c","references":[{"source_name":"Trend Micro Bouncing Golf 2019","description":"E. Xu, G. Guo. (2019, June 28).  Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/"}]},{"id":"S0422","name":"Anubis","url":"https://attack.mitre.org/software/S0422","kind":"malware","description":"[Anubis](https://attack.mitre.org/software/S0422) can record phone calls and audio.(Citation: Cofense Anubis)","relationship_id":"relationship--e7af5be1-721f-40c5-b647-659243a0a14b","references":[{"source_name":"Cofense Anubis","description":"M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved September 25, 2024.","url":"https://web.archive.org/web/20231222134431/https://cofense.com/blog/infostealer-keylogger-ransomware-one-anubis-targets-250-android-applications/"}]},{"id":"S0425","name":"Corona Updates","url":"https://attack.mitre.org/software/S0425","kind":"malware","description":"[Corona Updates](https://attack.mitre.org/software/S0425) can record MP4 files and monitor calls.(Citation: TrendMicro Coronavirus Updates)","relationship_id":"relationship--8b66543e-2ea1-4ff7-84d9-f8f431f53781","references":[{"source_name":"TrendMicro Coronavirus Updates","description":"T. Bao, J. Lu. (2020, April 14).  Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/coronavirus-update-app-leads-to-project-spy-android-and-ios-spyware/"}]},{"id":"S0489","name":"WolfRAT","url":"https://attack.mitre.org/software/S0489","kind":"malware","description":"[WolfRAT](https://attack.mitre.org/software/S0489) can record call audio.(Citation: Talos-WolfRAT)","relationship_id":"relationship--33857221-2543-4a7f-8255-b0d140d70ad7","references":[{"source_name":"Talos-WolfRAT","description":"W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19).  The wolf is back... . Retrieved July 20, 2020.","url":"https://blog.talosintelligence.com/2020/05/the-wolf-is-back.html"}]},{"id":"S0505","name":"Desert Scorpion","url":"https://attack.mitre.org/software/S0505","kind":"malware","description":"[Desert Scorpion](https://attack.mitre.org/software/S0505) can record audio from phone calls and the device microphone.(Citation: Lookout Desert Scorpion)","relationship_id":"relationship--670a0995-a789-4674-9e91-c74316cdef90","references":[{"source_name":"Lookout Desert Scorpion","description":"A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.","url":"https://blog.lookout.com/desert-scorpion-google-play"}]},{"id":"S0506","name":"ViperRAT","url":"https://attack.mitre.org/software/S0506","kind":"malware","description":"[ViperRAT](https://attack.mitre.org/software/S0506) can collect and record audio content.(Citation: Lookout ViperRAT)","relationship_id":"relationship--d8ca4ea5-5242-4f0f-b3b7-008673f561ab","references":[{"source_name":"Lookout ViperRAT","description":"M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020.","url":"https://blog.lookout.com/viperrat-mobile-apt"}]},{"id":"S0507","name":"eSurv","url":"https://attack.mitre.org/software/S0507","kind":"malware","description":"[eSurv](https://attack.mitre.org/software/S0507) can record audio.(Citation: Lookout eSurv)","relationship_id":"relationship--146275c0-b6dd-4700-bded-bc361a67d023","references":[{"source_name":"Lookout eSurv","description":"A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.","url":"https://blog.lookout.com/esurv-research"}]},{"id":"S0529","name":"CarbonSteal","url":"https://attack.mitre.org/software/S0529","kind":"malware","description":"[CarbonSteal](https://attack.mitre.org/software/S0529) can remotely capture device audio.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--b4735277-516a-4cd2-9607-a3e415945d93","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0535","name":"Golden Cup","url":"https://attack.mitre.org/software/S0535","kind":"malware","description":"[Golden Cup](https://attack.mitre.org/software/S0535) can record audio from the microphone and phone calls.(Citation: Symantec GoldenCup) ","relationship_id":"relationship--36298fd6-d909-4490-8a04-095aef9ffafe","references":[{"source_name":"Symantec GoldenCup","description":"R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/expert-perspectives/goldencup-new-cyber-threat-targeting-world-cup-fans"}]},{"id":"S0544","name":"HenBox","url":"https://attack.mitre.org/software/S0544","kind":"malware","description":"[HenBox](https://attack.mitre.org/software/S0544) can access the device’s microphone.(Citation: Palo Alto HenBox)","relationship_id":"relationship--88ea5004-8bdb-4af4-a2dc-a8c56236ff03","references":[{"source_name":"Palo Alto HenBox","description":"A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.","url":"https://unit42.paloaltonetworks.com/unit42-henbox-chickens-come-home-roost/"}]},{"id":"S0550","name":"DoubleAgent","url":"https://attack.mitre.org/software/S0550","kind":"malware","description":"[DoubleAgent](https://attack.mitre.org/software/S0550) has captured audio and can record phone calls.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--3752c235-0576-47dc-b05d-d3eaeaccfecc","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0551","name":"GoldenEagle","url":"https://attack.mitre.org/software/S0551","kind":"malware","description":"[GoldenEagle](https://attack.mitre.org/software/S0551) has recorded calls and environment audio in .amr format.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--901492b5-b074-4631-ad6e-4178caa4164a","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0558","name":"Tiktok Pro","url":"https://attack.mitre.org/software/S0558","kind":"malware","description":"[Tiktok Pro](https://attack.mitre.org/software/S0558) can capture audio from the device’s microphone and can record phone calls.(Citation: Zscaler TikTok Spyware)","relationship_id":"relationship--3d5f7bdf-ab59-48f9-89d5-23f9d8cd235b","references":[{"source_name":"Zscaler TikTok Spyware","description":"S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.","url":"https://www.zscaler.com/blogs/security-research/tiktok-spyware"}]},{"id":"S0577","name":"FrozenCell","url":"https://attack.mitre.org/software/S0577","kind":"malware","description":"[FrozenCell](https://attack.mitre.org/software/S0577) has recorded calls.(Citation: Lookout FrozenCell)","relationship_id":"relationship--db1201f0-f925-4c3c-8673-7524a8c20886","references":[{"source_name":"Lookout FrozenCell","description":"Michael Flossman. (2017, October 5). FrozenCell: Multi-platform surveillance campaign against Palestinians. Retrieved November 11, 2020.","url":"https://blog.lookout.com/frozencell-mobile-threat"}]},{"id":"S0655","name":"BusyGasper","url":"https://attack.mitre.org/software/S0655","kind":"malware","description":"[BusyGasper](https://attack.mitre.org/software/S0655) can record audio.(Citation: SecureList BusyGasper)","relationship_id":"relationship--4f6f4def-e76d-4d1b-9416-b6543e7dbc54","references":[{"source_name":"SecureList BusyGasper","description":"Alexey Firsh. (2018, August 29). BusyGasper – the unfriendly spy. Retrieved October 1, 2021.","url":"https://securelist.com/busygasper-the-unfriendly-spy/87627/"}]},{"id":"S1061","name":"AbstractEmu","url":"https://attack.mitre.org/software/S1061","kind":"malware","description":"[AbstractEmu](https://attack.mitre.org/software/S1061) can grant itself microphone permissions.(Citation: lookout_abstractemu_1021)","relationship_id":"relationship--644a19d3-c94f-40d9-87ac-02ef20b14eda","references":[{"source_name":"lookout_abstractemu_1021","description":"P Shunk, K Balaam. (2021, October 28). Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign. Retrieved February 6, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-global-rooting-malware-campaign"}]},{"id":"S1069","name":"TangleBot","url":"https://attack.mitre.org/software/S1069","kind":"malware","description":"[TangleBot](https://attack.mitre.org/software/S1069) can record audio using the device microphone.(Citation: cloudmark_tanglebot_0921)","relationship_id":"relationship--6846dc09-b66a-42d3-aea2-c80b51f22952","references":[{"source_name":"cloudmark_tanglebot_0921","description":"Felipe Naves, Andrew Conway, W. Stuart Jones, Adam McNeil . (2021, September 23). TangleBot: New Advanced SMS Malware Targets Mobile Users Across U.S. and Canada with COVID-19 Lures. Retrieved February 28, 2023.","url":"https://www.cloudmark.com/en/blog/malware/tanglebot-new-advanced-sms-malware-targets-mobile-users-across-us-and-canada-covid-19"}]},{"id":"S1077","name":"Hornbill","url":"https://attack.mitre.org/software/S1077","kind":"malware","description":"[Hornbill](https://attack.mitre.org/software/S1077) can record environmental and call audio.(Citation: lookout_hornbill_sunbird_0221)","relationship_id":"relationship--3e11a61b-14b3-4268-a6dd-937d4baef6de","references":[{"source_name":"lookout_hornbill_sunbird_0221","description":"Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict"}]},{"id":"S1079","name":"BOULDSPY","url":"https://attack.mitre.org/software/S1079","kind":"malware","description":"[BOULDSPY](https://attack.mitre.org/software/S1079) can access a device’s microphone to record audio, as well as cell and VoIP application calls.(Citation: lookout_bouldspy_0423)","relationship_id":"relationship--1b9b145c-ce80-4d0e-99f2-d756b806745b","references":[{"source_name":"lookout_bouldspy_0423","description":"Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.","url":"https://www.lookout.com/blog/iranian-spyware-bouldspy"}]},{"id":"S1080","name":"Fakecalls","url":"https://attack.mitre.org/software/S1080","kind":"malware","description":"[Fakecalls](https://attack.mitre.org/software/S1080) can turn on a device’s microphone to capture audio.(Citation: kaspersky_fakecalls_0422)","relationship_id":"relationship--642a2599-a50c-480c-8e07-2a3a217f4a46","references":[{"source_name":"kaspersky_fakecalls_0422","description":"Igor Golovin. (2022, April 11). Fakecalls: a talking Trojan. Retrieved July 21, 2023.","url":"https://www.kaspersky.com/blog/fakecalls-banking-trojan/44072/"}]},{"id":"S1082","name":"Sunbird","url":"https://attack.mitre.org/software/S1082","kind":"malware","description":"[Sunbird](https://attack.mitre.org/software/S1082) can record environmental and call audio.(Citation: lookout_hornbill_sunbird_0221)","relationship_id":"relationship--22755928-b0e1-4004-a89e-5f5ea2504cf8","references":[{"source_name":"lookout_hornbill_sunbird_0221","description":"Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict"}]},{"id":"S1092","name":"Escobar","url":"https://attack.mitre.org/software/S1092","kind":"malware","description":"[Escobar](https://attack.mitre.org/software/S1092) can record audio from the device’s microphone.(Citation: Bleeipng Computer Escobar)","relationship_id":"relationship--f5acd046-2943-48bf-836a-2109c4f1a5c4","references":[{"source_name":"Bleeipng Computer Escobar","description":"B. Toulas. (2022, March 12). Android malware Escobar steals your Google Authenticator MFA codes. Retrieved September 28, 2023.","url":"https://www.bleepingcomputer.com/news/security/android-malware-escobar-steals-your-google-authenticator-mfa-codes/"}]},{"id":"S1095","name":"AhRat","url":"https://attack.mitre.org/software/S1095","kind":"malware","description":"[AhRat](https://attack.mitre.org/software/S1095) can record audio using a device’s microphone.(Citation: welivesecurity_ahrat_0523)","relationship_id":"relationship--be07d829-9a12-4d90-ad8c-9e56782af120","references":[{"source_name":"welivesecurity_ahrat_0523","description":"Lukas Stefanko. (2023, May 23). Android app breaking bad: From legitimate screen recording to file exfiltration within a year. Retrieved December 18, 2023.","url":"https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/"}]},{"id":"S1126","name":"Phenakite","url":"https://attack.mitre.org/software/S1126","kind":"malware","description":"[Phenakite](https://attack.mitre.org/software/S1126) can record phone calls.(Citation: fb_arid_viper)","relationship_id":"relationship--89fcec02-8696-4c41-a7b1-8a75236a4c05","references":[{"source_name":"fb_arid_viper","description":"Flossman, M., Scott, M. (2021, April). Technical Paper // Taking Action Against Arid Viper. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20231126111812/https:/about.fb.com/wp-content/uploads/2021/04/Technical-threat-report-Arid-Viper-April-2021.pdf"}]},{"id":"S1128","name":"HilalRAT","url":"https://attack.mitre.org/software/S1128","kind":"malware","description":"[HilalRAT](https://attack.mitre.org/software/S1128) can activate a device’s microphone.(Citation: Meta Adversarial Threat Report 2022)","relationship_id":"relationship--70000e5a-cdff-4ff8-a565-5f7db60f8c49","references":[{"source_name":"Meta Adversarial Threat Report 2022","description":"Agranovich, D., et al. (2022, April). Adversarial Threat Report. Retrieved April 2, 2024.","url":"https://about.fb.com/wp-content/uploads/2022/04/Meta-Quarterly-Adversarial-Threat-Report_Q1-2022.pdf"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"[LightSpy](https://attack.mitre.org/software/S1185) has captured environment audio, phone calls and Voice over IP (VoIP) calls.(Citation: FirshSecureList LightSpy 2020)(Citation: MelikovBlackBerry LightSpy 2024)(Citation: Threatfabric LightSpy 2023)(Citation: Threatfabric LightSpy 2024)(Citation: LinkedIn Dmitry LightSpy 2025)","relationship_id":"relationship--841dcc87-1c22-4775-abe8-606aa6a48bf7","references":[{"source_name":"LinkedIn Dmitry LightSpy 2025","description":"Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.","url":"https://www.linkedin.com/pulse/coordinated-kill-switch-lightspys-ios-destructive-plugin-bestuzhev-zhoye/"},{"source_name":"FirshSecureList LightSpy 2020","description":"Firsh, A., et al. (2020, March 26). iOS exploit chain deploys LightSpy feature-rich malware. Retrieved January 13, 2025.","url":"https://securelist.com/ios-exploit-chain-deploys-lightspy-malware/96407/"},{"source_name":"MelikovBlackBerry LightSpy 2024","description":"Melikov, D. (2024, April 11). LightSpy Returns: Renewed Espionage Campaign Targets Southern Asia, Possibly India. Retrieved January 14, 2025.","url":"https://blogs.blackberry.com/en/2024/04/lightspy-returns-renewed-espionage-campaign-targets-southern-asia-possibly-india"},{"source_name":"Threatfabric LightSpy 2023","description":"ThreatFabric. (2023, October 2). LightSpy mAPT Mobile Payment System Attack. Retrieved January 17, 2025.","url":"https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack"},{"source_name":"Threatfabric LightSpy 2024","description":"ThreatFabric. (2024, October 29). LightSpy: Implant for iOS. Retrieved January 30, 2025.","url":"https://www.threatfabric.com/blogs/lightspy-implant-for-ios"}]},{"id":"S1195","name":"SpyC23","url":"https://attack.mitre.org/software/S1195","kind":"malware","description":"[SpyC23](https://attack.mitre.org/software/S1195) can record phone calls and audio.(Citation: welivesecurity_apt-c-23)(Citation: sophos_android_apt_spyware)(Citation: SentinelLabs AridViper 2023)(Citation: Cyware APT-C-23 2020)(Citation: threatpost AndroidSpyware 2020)","relationship_id":"relationship--6d8ffc4a-6496-423e-a44d-d5a973ee1acf","references":[{"source_name":"Cyware APT-C-23 2020","description":"Cyware. (2020, October 2). APT‑C‑23 is Still Active and Enhancing its Mobile Spying Capabilities. Retrieved December 2, 2024.","url":"https://social.cyware.com/news/aptc23-is-still-active-and-enhancing-its-mobile-spying-capabilities-82e0cea4"},{"source_name":"SentinelLabs AridViper 2023","description":"Delamotte, A. (2023, November 6). Arid Viper | APT’s Nest of SpyC23 Malware Continues to Target Android Devices. Retrieved December 2, 2024.","url":"https://www.sentinelone.com/labs/arid-viper-apts-nest-of-spyc23-malware-continues-to-target-android-devices/"},{"source_name":"sophos_android_apt_spyware","description":"Kohli, P. (2021, November 23). Android APT spyware, targeting Middle East victims, enhances evasiveness. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20231208015605/https:/news.sophos.com/en-us/2021/11/23/android-apt-spyware-targeting-middle-east-victims-improves-its-capabilities/"},{"source_name":"threatpost AndroidSpyware 2020","description":"O'Donnell, L. (2020, September 30). Android Spyware Variant Snoops on WhatsApp, Telegram Messages. Retrieved January 10, 2025.","url":"https://threatpost.com/new-android-spyware-whatsapp-telegram/159694/"},{"source_name":"welivesecurity_apt-c-23","description":"Stefanko, L. (2020, September 30). APT‑C‑23 group evolves its Android spyware. Retrieved March 4, 2024.","url":"https://web.archive.org/web/20201123042131/www.welivesecurity.com/2020/09/30/aptc23-group-evolves-its-android-spyware/"}]},{"id":"S1231","name":"GodFather","url":"https://attack.mitre.org/software/S1231","kind":"malware","description":"[GodFather](https://attack.mitre.org/software/S1231) has requested for the `RECORD_AUDIO` permission to record audio with the microphone.(Citation: MerkleScience_Godfather_April2023) ","relationship_id":"relationship--61e27ee2-ef0a-43b9-8e58-e8703654bc25","references":[{"source_name":"MerkleScience_Godfather_April2023","description":"Merkle Science. (2023, April 25). The Godfather Android Malware: Threat under the lens. Retrieved July 16, 2025.","url":"https://www.merklescience.com/blog/the-godfather-android-malware-threat-under-the-lens"}]},{"id":"S1241","name":"RatMilad","url":"https://attack.mitre.org/software/S1241","kind":"malware","description":"[RatMilad](https://attack.mitre.org/software/S1241) has captured audio from the device.(Citation: ZimperiumGupta_RatMilad_Oct2022) ","relationship_id":"relationship--f3c5d1a4-406d-47cc-8152-77bfbe5edaaf","references":[{"source_name":"ZimperiumGupta_RatMilad_Oct2022","description":"Gupta, N. (2022, October 5). We Smell A RatMilad Android Spyware. Retrieved August 27, 2025.","url":"https://zimperium.com/blog/we-smell-a-ratmilad-mobile-spyware"}]},{"id":"S1243","name":"DCHSpy","url":"https://attack.mitre.org/software/S1243","kind":"malware","description":"[DCHSpy](https://attack.mitre.org/software/S1243) has captured audio from the device by taking control of the microphone.(Citation: Lookout_DCHSpy_July2025) ","relationship_id":"relationship--76abec4d-469b-4f99-8c8d-625adca37702","references":[{"source_name":"Lookout_DCHSpy_July2025","description":"Albrecht, J., Islamoglu, A. (2025, July 21). Lookout Discovers Iranian APT MuddyWater Leveraging DCHSpy During Israel-Iran Conflict . Retrieved September 19, 2025.","url":"https://www.lookout.com/threat-intelligence/article/lookout-discovers-iranian-dchsy-surveillanceware"}]},{"id":"S9005","name":"DocSwap","url":"https://attack.mitre.org/software/S9005","kind":"malware","description":"[DocSwap](https://attack.mitre.org/software/S9005) has the ability to start and stop audio recording.(Citation: EnkiWhiteHat_KimsukyDOCSWAP_Dec2025)(Citation: S2W_DocSwap_Mar2025) ","relationship_id":"relationship--066671b9-93d5-4309-8130-e01594b7c9d1","references":[{"source_name":"EnkiWhiteHat_KimsukyDOCSWAP_Dec2025","description":"EnkiWhiteHat. (2025, December 16). Kimsuky Distributing Malicious Mobile App via QR Code. Retrieved January 8, 2026.","url":"https://www.enki.co.kr/en/media-center/blog/kimsuky-distributing-malicious-mobile-app-via-qr-code"},{"source_name":"S2W_DocSwap_Mar2025","description":"Kim, H., S2W TALON. (2025, March 13). Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer. Retrieved January 12, 2026.","url":"https://medium.com/s2wblog/detailed-analysis-of-docswap-malware-disguised-as-security-document-viewer-218a728c36ff"}]},{"id":"S9006","name":"VajraSpy","url":"https://attack.mitre.org/software/S9006","kind":"malware","description":"[VajraSpy](https://attack.mitre.org/software/S9006) has recorded surrounding audio and phone calls from WhatsApp, WhatsApp Business, Signal, and Telegram by requesting `android.permission.RECORD_AUDIO`.(Citation: ESET_VajraSpy_Feb2024)(Citation: K7Dhanalakshmi_VajraSpy_April2022) ","relationship_id":"relationship--4b06c7b6-f557-456a-8c03-0ed740713d29","references":[{"source_name":"K7Dhanalakshmi_VajraSpy_April2022","description":"Dhanalakshmi. (2022, April 19).  VajraSpy – An Android RAT. Retrieved November 5, 2025.","url":"https://labs.k7computing.com/index.php/vajraspy-an-android-rat/"},{"source_name":"ESET_VajraSpy_Feb2024","description":"Stefanko, L. (2024, February 1). VajraSpy: A Patchwork of espionage apps. Retrieved October 27, 2025.","url":"https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/"}]}],"actors":[{"id":"G0112","name":"Windshift","url":"https://attack.mitre.org/groups/G0112","kind":"intrusion-set","description":"[Windshift](https://attack.mitre.org/groups/G0112) has included phone call and audio recording capabilities in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)","relationship_id":"relationship--3fcd2177-2030-4781-bd19-8b9fa8c6e645","references":[{"source_name":"BlackBerry Bahamut","description":"The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]}],"mitigations":[{"id":"M1006","name":"Use Recent OS Version","url":"https://attack.mitre.org/mitigations/M1006","kind":"course-of-action","description":"Android 9 and above restricts access to microphone, camera, and other sensors from background applications.(Citation: Android Capture Sensor 2019) ","relationship_id":"relationship--7b679dbf-4e31-4d0b-9e13-eb8c3b98b7fb","references":[{"source_name":"Android Capture Sensor 2019","description":"Android Developers. (, January). Android 9+ Privacy Changes . Retrieved August 27, 2019.","url":"https://developer.android.com/about/versions/pie/android-9.0-changes-all#bg-sensor-access"}]},{"id":"M1011","name":"User Guidance","url":"https://attack.mitre.org/mitigations/M1011","kind":"course-of-action","description":"Users should be wary of granting applications dangerous or privacy-intrusive permissions, such as access to microphone or audio output. ","relationship_id":"relationship--f84355c2-b829-4324-821a-b5148734bb6b","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1429":"/ttp-simulation/techniques/mobile/T1429/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1429","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0112","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","api":"android.hardware.camera2.CameraManager.openCamera","result":"permission_denied","thread":"main"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0116","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","action":"permission_prompt","prompt_observed":true,"result":"denied"}}]}}