Mobile ATT&CK Collection Tactic (TA0035) Guide: Detecting Data Collection on Android and iOS

A compromised phone is the most complete surveillance device an adversary can get: messages, contacts, call logs, location, microphone, camera and the screen itself, all in one pocket. ATT&CK for Mobile v20 describes the Collection tactic (TA0035) as the adversary "trying to gather data of interest to their goal", covering the techniques used to identify and gather information before exfiltration. With 15 techniques it is the largest mobile tactic, and the one where commodity spyware, stalkerware, banking trojans and state-grade implants overlap most. This hub explains what collection looks like on Android and iOS, which techniques matter most, how to detect them with MDM, mobile threat defence (MTD) and forensic tooling, and which OS controls reduce them. It is written for mobile security engineers, SOC analysts and teams protecting high-risk staff. For the wider matrix see the MITRE ATT&CK for Mobile Guide.

Key takeaways

• Protected user data is the core target. In the ATT&CK Mobile v20 dataset SMS Messages (T1636.004) has 75 recorded uses, Contact List (T1636.003) 58 and Call Log (T1636.002) 41.
• Surveillance features travel together. Of 51 software entries that capture audio, 42 also track location; of 79 that take protected user data, 50 also track location.
• Permissions are the main detection surface. Most v20 collection analytics name application permission, application state and network telemetry, because the sandbox hides activity but not grants.
• Not all collection needs malware. Linked Devices (T1676) adds an attacker's device to the victim's Signal or WhatsApp account, and Remote Device Management Services (T1430.001) abuses legitimate location services.
• High-risk users need a different playbook. Exploit-led implants such as Pegasus and Operation Triangulation collect without permission prompts, so patch currency, Lockdown Mode and MVT checks replace permission hygiene.

What the Collection tactic means on a mobile device

On a desktop, collection usually means staging files from shares. On a phone, the valuable data sits behind OS permission gates: SMS, contacts, call log, calendar, location, microphone and camera. Adversaries collect either by persuading the user to grant those permissions, by abusing Accessibility to read the screen, or by exploiting the OS to bypass permissions entirely. MITRE maps several of these techniques to other tactics too: Clipboard Data, Input Capture, Abuse Accessibility Features and Access Notifications also sit under Credential Access, Location Tracking under Discovery, Call Control under Impact and Command and Control, and Linked Devices under Persistence.

All Collection techniques in ATT&CK Mobile v20

Use counts are the number of software, group and campaign "uses" relationships in the ATT&CK Mobile v20.0 STIX bundle, excluding revoked and deprecated objects, counted per technique ID (sub-techniques separately). They show what MITRE has documented, not prevalence.

Sub-techniques of T1417, T1430 and T1636 are covered on their parent technique guides.

How adversaries chain Collection

Three distinct chains appear in the v20 procedure data.

• Commodity spyware and stalkerware: an app is sideloaded or delivered by Phishing, requests SMS, contacts, location and microphone permissions under a cover story, then collects continuously. Only 12 of the 79 Protected User Data entries are also recorded for Archive Collected Data, so most send records straight out over Exfiltration Over C2 Channel. See the Spyware and Stalkerware Guide.
• Banking trojans: collection is a means to fraud. Accessibility gives screen capture, keylogging and notification access; SMS collection yields one-time codes. See the Mobile ATT&CK Credential Access Tactic hub.
• Exploit-led implants: Operation Triangulation (C0054) reached iPhones through an iMessage zero-click chain and stole data from SQLite databases, location and the Keychain. Pegasus for iOS is recorded for audio, location, SMS and stored app data. No permission prompt is shown, so permission-based detection does not apply. See the Commercial Spyware Guide.
• Account-level collection without malware: Google Threat Intelligence Group reported in February 2025 that Russia-linked actors used malicious QR codes disguised as group invites or security alerts to link victims' Signal accounts to attacker-controlled devices, and that APT44 linked accounts on devices captured on the battlefield. Messages then arrive at both the victim and the attacker in real time.

Where to start: ranking the techniques for defenders

1. T1636 Protected User Data: the most documented collection and governed by permissions you can see. Control sources and grants first.
2. T1429 Audio Capture, T1512 Video Capture and T1430 Location Tracking: the surveillance trio, highest harm for executives, journalists and staff in sensitive roles.
3. T1676 Linked Devices: cheap, malware-free and, as GTIG notes, low-signature; a quarterly linked-device review costs almost nothing.
4. T1513 Screen Capture and T1453 Abuse Accessibility Features: they expose everything the user sees, including data in managed apps; block with Accessibility allow-lists and app screenshot protection.
5. T1409 Stored Application Data and T1533 Data from Local System: mostly reachable after privilege escalation; patch currency and app data encryption matter most.
6. T1638 Adversary-in-the-Middle: malicious VPN profiles and certificates; watch configuration profiles and user-installed CAs.

Detection priorities

Each technique has a v20 detection strategy. The log sources named in the analytics fall into four groups: MDM and EMM state, application vetting, network telemetry (Android enterprise network logs, iOS NetworkExtension, web proxy) and forensic artefacts.

Where you suspect an exploit-led implant, permission signals will be absent. Capture the device with the Mobile Verification Toolkit (MVT), which checks iOS backups, filesystem dumps and sysdiagnose files and Android backups against published indicators, and follow the Mobile Spyware Infection Response Playbook.

Metrics

• Sensitive permission exposure: managed devices with SMS, call log, microphone or always-on location granted to apps outside the approved list.
• Linked-device review: percentage of high-risk staff whose messaging app linked devices were reviewed this quarter.
• Patch currency: devices at the minimum OS version and patch level, with the high-risk group tracked separately.
• Profile hygiene: devices with unmanaged configuration profiles, VPNs or user-installed CA certificates.
• Forensic readiness: time from report of a suspicious device to an MVT capture.

Mitigation priorities and OS controls

MITRE maps six mitigation IDs across the tactic, and two techniques (T1532 and T1533) have none, because archiving and reading local data happen after access is already gained. See ATT&CK Mitigations.

Lockdown Mode has an operational catch: a device cannot be newly enrolled in MDM or supervision while it is on, so enrol first. See the Mobile App Permissions guide and the Mobile Communications Protection for High-Risk Individuals Guide.

Decision guidance

• Corporate-owned devices: full permission policy, store-only installs and patch gating cover most commodity collection.
• BYOD: you see only the work profile or managed apps. Protect business data with app protection policies (no copy-paste out, no screenshots in managed apps) and accept that personal-side collection is out of reach.
• High-risk staff: assume exploit-led collection. Lockdown Mode, rapid patching, MVT checks and linked-device reviews matter more than MTD alone.
• App publishers: minimise what your app stores and shows; Screen Capture and Access Notifications collect whatever your UI displays.

Where identity fits

Collection on mobile is often the reconnaissance for identity attacks: contact lists drive the next smishing wave (FluBot spread by texting victims' contacts), SMS collection yields one-time codes and Accounts (T1636.005) reveals which services the user holds. Linked Devices is itself an identity attack: the attacker adds a second authenticated device to the user's messaging identity, which persists until someone looks. Treat messaging and device-finder accounts as identities to govern, with device lists reviewed like any other credential inventory. See Mobile Access Credentials.

Common failure patterns

• Relying on MTD alone for high-risk users: exploit-led implants do not request permissions, so app reputation and permission alerts stay silent.
• Never reviewing linked devices: GTIG notes this access can go unnoticed for long periods.
• Allowing unmanaged configuration profiles and user CAs: enables adversary-in-the-middle collection of app traffic.
• Granting "always" location and microphone casually: the surveillance trio co-occurs in most spyware families.
• Sensitive data shown in notifications and recent-app thumbnails: collected by notification and screen capture without touching app storage.
• Wiping before capture: removes the evidence needed to know what was collected and whom to notify.

Framework mapping

Practitioner checklist

• Inventory which managed apps hold SMS, contacts, call log, microphone, camera and location permissions, and remove grants without a business reason.
• Block sideloading, unmanaged configuration profiles and user-installed CA certificates on managed devices.
• Enforce Accessibility and screen capture restrictions for managed apps.
• Gate access on minimum OS version and patch level, with a faster cycle for high-risk users.
• Enrol high-risk users' devices, then enable Lockdown Mode or Android Advanced Protection.
• Review Signal, WhatsApp and similar linked devices for high-risk staff every quarter.
• Prepare MVT capture and the spyware response playbook before you need them.
• Feed MDM permission and profile events into the SIEM and alert on changes for privileged users.

Standards and references

• MITRE ATT&CK: Collection, Mobile (TA0035)
• MITRE ATT&CK: Mobile Matrix
• NIST: SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise
• NIST: SP 800-53 Rev. 5, Security and Privacy Controls
• Google Threat Intelligence Group: Signals of Trouble, Russia-aligned targeting of Signal Messenger
• Apple: About Lockdown Mode
• Amnesty International Security Lab: Mobile Verification Toolkit documentation
• Google Play: Use of SMS or Call Log permission groups

Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide, ATT&CK Collection Tactic Guide, Spyware and Stalkerware Guide, Mobile Forensics Guide, Mobile ATT&CK Impact Tactic.