T1517

Reported Context (7)

The article reports that selected GhostBat RAT variants register a notification-listener service to monitor other apps' notifications, including potentially sensitive OTPs. GhostBat RAT Uses Android Accessibility Overlays to Steal PINs
Massiv monitors launched applications and displays fake overlays to collect credentials and other sensitive information. Massiv Android Banking Trojan Uses IPTV Lures for Device Takeover and Fraud
Herodotus displays blocking overlays to hide activity and keep victims from seeing banking-app screens. Herodotus Android Banking Trojan Mimics Human Typing to Evade Detection
Datzbro's photo-stealing functionality could list albums and upload photos from infected devices. Datzbro Android Trojan Uses Senior Travel Scams to Enable Device Takeover and Financial Fraud
RatOn abused Android Accessibility services to accept permissions and interact with app interfaces. RatOn Android Trojan Combines NFC Relay, Remote Control and Automated Transfers

Malware (13)

People (1)

Threat Actors (3)

MITRE ATT&CK (41)

Products (17)

Tools (2)

Industries (3)

Countries (16)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.