Skip to content
attack.paths
Connexion
← RegistryDossier · 6 steps · 5 edges

Deeplink abuse → in-app account takeover

Exported activity registers a custom URL scheme that triggers an OAuth-style 'confirm reset' action without validating the source — phishing URL clicks reset another user's password.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target Android app declares an exported activity with an intent-filter for a custom scheme (myapp://...). The activity processes parameters without checking caller identity.

§ Steps

  1. 01
    Account takeoverInitial Access
    T1078— Valid Accounts
  2. 02
    Lure victim to click the linkInitial Access
    T1566— Phishing
  3. 03
    App fires privileged internal actionPrivilege Escalation
    W-IDOR— Insecure Direct Object Reference (IDOR)
  4. 04
    Reverse the APKReconnaissance
    MOB-APK-REVERSE— APK Reverse Engineering
  5. 05
    Locate exported activity + deeplink handlerInitial Access
    MOB-DEEPLINK-ABUSE— Android Deeplink / Intent Abuse
  6. 06
    Craft malicious deeplink URLPrivilege Escalation
    MOB-INTENT-INJECT— Intent Injection / Pending Intent Abuse

§ References

§ Frequently asked

What is the "Deeplink abuse → in-app account takeover" attack path?
Exported activity registers a custom URL scheme that triggers an OAuth-style 'confirm reset' action without validating the source — phishing URL clicks reset another user's password. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Account takeover (T1078) — a initial access primitive. Assumed environment: target Android app declares an exported activity with an intent-filter for a custom scheme (myapp://.
What is the final impact of this kill-chain?
The final step lands on Craft malicious deeplink URL (MOB-INTENT-INJECT), which falls under Privilege Escalation. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers