Capture SMS Messages

A malicious application could capture sensitive data sent via SMS, including authentication credentials. SMS is frequently used to transmit codes used for multi-factor authentication.

On Android, a malicious application must request and obtain permission (either at app install time or run time) in order to receive SMS messages. Alternatively, a malicious application could attempt to perform an operating system privilege escalation attack to bypass the permission requirement.

On iOS, applications cannot access SMS messages in normal operation, so an adversary would need to attempt to perform an operating system privilege escalation attack to potentially be able to access SMS messages.

ID: T1412

Tactic Type:  Post-Adversary Device Access

Tactic: Collection, Credential Access

Platform:  Android, iOS

Version: 1.0

Mitigations

MitigationDescription
Application VettingEnterprises performing application vetting could search for applications that declare the RECEIVE_SMS permission and scrutinize them closely.
Security Updates
Use Recent OS Version

Examples

NameDescription
Adups

Adups transmitted the full contents of text messages.[1]

Android/Chuli.A

Android/Chuli.A stole SMS message content.[2]

AndroRAT

AndroRAT captures SMS messages.[3]

DroidJack

DroidJack captures SMS data.[4]

MazarBOT

MazarBOT can intercept two-factor authentication codes sent by online banking apps.[5]

Pegasus for iOS

Pegasus for iOS captures SMS messages that the victim sends or receives.[6]

RCSAndroid

RCSAndroid can collect SMS, MMS, and Gmail messages.[7]

RuMMS

RuMMS uploads incoming SMS messages to a remote command and control server.[8]

SpyDealer

SpyDealer harvests SMS and MMS messages from victims..[9]

SpyNote RAT

SpyNote RAT can read SMS messages.[10]

Stealth Mango

Stealth Mango uploads SMS logs and deletes incoming messages from specified numbers, including those that contain particular strings.[11]

Tangelo

Tangelo contains functionality to gather SMS messages.[11]

Xbot

Xbot steals all SMS message and contact information as well as intercepts and parses certain SMS messages.[12]

XLoader

XLoader collects SMS messages.[13]

References