T1636.003: Contact List
Essential information
- MITRE technique ID
T1636.003- Confidence
- 100/100
- Revoked
- No
- Published
- 01/04/2022 15:17
- Modified
- 27/03/2026 01:41
- Author / Source
- The MITRE Corporation
Platforms
android iOS
Description
Adversaries may utilize standard operating system APIs to gather contact list data. On Android, this can be accomplished using the Contacts Content Provider. On iOS, this can be accomplished using the `Contacts` framework.
If the device has been jailbroken or rooted, an adversary may be able to access the [Contact List](https://attack.mitre.org/techniques/T1636/003) without the user’s knowledge or approval.
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-mobile-attack | collection |
Marking (TLP)
Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.