MITRE ATT&CK Mobile T1634: Credentials from Password Store (Mobile Tactic TA0031 - Credential Access)

What MITRE ATT&CK Mobile T1634: Credentials from Password Store (Mobile Tactic TA0031 - Credential Access) requires

MITRE ATT&CK T1634 (Credentials from Password Store) is an ATT&CK for Mobile Credential Access technique. Adversaries may search common password storage locations to obtain user credentials. Passwords can be stored in several places on a device, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users to manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information. ATT&CK documents 1 sub-technique: T1634.001 Keychain. Affected platforms: iOS. MITRE-documented mitigations include M1001 Security Updates, M1002 Attestation, M1010 Deploy Compromised Device Detection Method. Mobile controls map to NIST SP 800-124 Rev 2 and OWASP MASVS.

Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated: 2026-05-25

Primary source: https://attack.mitre.org/techniques/T1634/

SHA-256 integrity: 519f3bd87498e110f8f684fc7b3f0158140c11e8c6924ec5e26088476adf0aa3

Primary Citations — 6 traced to source

• MITRE ATT&CK for Mobile Technique T1634: Credentials from Password Store (https://attack.mitre.org/techniques/T1634/) with 1 sub-techniques
• MITRE ATT&CK Mobile Tactic TA0031: Credential Access (https://attack.mitre.org/tactics/TA0031/)

+ 4 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

• Discovery (free): /api/v1/nodes/mitre-attack-mobile-t1634-credentials-from-password-store.json — 6-field metadata
• Vault (full node): /api/v1/vault/nodes/mitre-attack-mobile-t1634-credentials-from-password-store.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
• Canonical URL: https://bidda.com/intelligence/mitre-attack-mobile-t1634-credentials-from-password-store
• Back to registry: Browse all 10,085 compliance nodes