T1636.003 · Contact List

T1636.003 · Contact List · Sunturai

attack-patternmobile-attackT1636.003

Contact List

attack-pattern--e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86

Adversaries may utilize standard operating system APIs to gather contact list data. On Android, this can be accomplished using the Contacts Content Provider. On iOS, this can be accomplished using the `Contacts` framework. If the device has been jailbroken or rooted, an adversary may be able to access the Contact List without the user’s knowledge or approval.

Created: Apr 1, 2022, 1:17 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

No published detection covers this technique

Nothing in the catalogue maps to it yet. That absence is the finding.

External references

mitre-attackT1636.003Open reference

NIST Mobile Threat CatalogueAPP-13Open reference

Platforms

AndroidiOS

Kill chain phases

collection

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object