# T1056.002 GUI Input Capture > As of 2026-10-05, T1056.002 (GUI Input Capture) appears in 36 tracked threats, first reported 2026-02-16 and most recently 2026-10-02, with linked actors including Woodgnat, ClickLock Dev, AMOS Operators; it most often appears alongside T1036.005 (Match Legitimate Resource Name or Location). - **Tracked threats:** 36 (2 critical, 33 high, 1 medium) - **First seen:** 2026-02-16 - **Last seen:** 2026-10-02 - **Threat actors:** 11 - **Detection rules:** 72 (counts only; Blue tier and above) ## Key facts - **ID:** T1056.002 - **Framework:** MITRE ATT&CK - **Tactics:** Credential Access, Collection - **Matrix:** Enterprise - **Parent:** T1056 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1056/002/ ## Activity timeline T1056.002 first appeared in tracked threats on 2026-02-16 and was most recently reported on 2026-10-02. The busiest month was 2026-07 with 10 reports, and 36 of the 36 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1056.002 GUI Input Capture is catalogued by MITRE ATT&CK under the Credential Access and Collection tactics in the Enterprise matrix, as a sub-technique of [T1056 Input Capture](https://intel.threadlinqs.com/technique/T1056). Threadlinqs maps 36 of 2623 tracked threats (1.4%) to it; by severity that is 2 critical, 33 high, 1 medium. Threats that use T1056.002 most often also use [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (27 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (26 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (26 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (25 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (24 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 11 tracked threat actors appear in the threats that use T1056.002; the most frequent are [Woodgnat](https://intel.threadlinqs.com/actor/Woodgnat) (3), [ClickLock Dev](https://intel.threadlinqs.com/actor/ClickLock%20Dev) (2), [AMOS Operators](https://intel.threadlinqs.com/actor/AMOS%20Operators) (1), [APT38](https://intel.threadlinqs.com/actor/APT38) (1), [Andariel](https://intel.threadlinqs.com/actor/Andariel) (1). ## Mitigations MITRE ATT&CK lists 1 mitigation for T1056.002. - [M1017 User Training](https://attack.mitre.org/mitigations/M1017/) ## Data sources Telemetry that can reveal T1056.002, per MITRE ATT&CK. - Command — Command Execution - Process — Process Creation - Script — Script Execution ## Threat actors using it - [Woodgnat](https://intel.threadlinqs.com/actor/Woodgnat) — 3 - [ClickLock Dev](https://intel.threadlinqs.com/actor/ClickLock%20Dev) — 2 - [AMOS Operators](https://intel.threadlinqs.com/actor/AMOS%20Operators) — 1 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 1 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 1 - [Grandoreiro operators](https://intel.threadlinqs.com/actor/Grandoreiro%20operators) — 1 - [KongTuke](https://intel.threadlinqs.com/actor/KongTuke) — 1 - [Kontraktnik](https://intel.threadlinqs.com/actor/Kontraktnik) — 1 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 1 - [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 1 - [SHADOW-WATER-063](https://intel.threadlinqs.com/actor/SHADOW-WATER-063) — 1 ## Tracked threats The 30 most recent of 36 tracked threats that use T1056.002. - [Atomic macOS (AMOS) Stealer Delivered via Malicious Ad Impersonating Claude Code (ClickFix-style)](https://intel.threadlinqs.com/threat/TL-2026-2916) — high — 2026-10-02 - [CloudSyncD macOS Backdoor Delivered via Fake Zoom Installer](https://intel.threadlinqs.com/threat/TL-2026-2840) — high — 2026-10-02 - [PamStealer macOS Infostealer Adds Live C2 with X25519 Key Exchange, Four-Method Persistence](https://intel.threadlinqs.com/threat/TL-2026-2674) — high — 2026-09-26 - [MacSync macOS infostealer/backdoor: reworked MaaS chain stages stage-two via a public iCloud calendar…](https://intel.threadlinqs.com/threat/TL-2026-2637) — high — 2026-09-24 - [SynkLoader: Modular Multi-Language Loader Deployed via Microsoft Teams Phishing, Likely Ransomware Precursor](https://intel.threadlinqs.com/threat/TL-2026-2131) — high — 2026-08-24 - [AmnesiaStealer: macOS Infostealer Hijacks Live Browser Sessions via Chrome DevTools Protocol Remote Control](https://intel.threadlinqs.com/threat/TL-2026-2029) — high — 2026-08-16 - [CSS Bomb Attacks: CSS-Based Trust-Boundary Bypass Leaks Webmail Passwords and Tokens (Outlook, Gmail, Yahoo…](https://intel.threadlinqs.com/threat/TL-2026-1968) — high — 2026-08-10 - [ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data](https://intel.threadlinqs.com/threat/TL-2026-1936) — high — 2026-08-07 - [ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials](https://intel.threadlinqs.com/threat/TL-2026-1920) — high — 2026-08-06 - [Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser…](https://intel.threadlinqs.com/threat/TL-2026-1907) — high — 2026-08-06 - [Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and…](https://intel.threadlinqs.com/threat/TL-2026-1899) — high — 2026-08-05 - [macOS ClickFix Campaign Using Browser Fingerprinting Gate to Distribute Atomic Stealer (AMOS) and MacSync…](https://intel.threadlinqs.com/threat/TL-2026-1894) — high — 2026-08-05 - [Dolphin X Stealer — MaaS Credential/Crypto Infostealer with AI-Driven Victim Profiler (thedolphinx\[.\]top)](https://intel.threadlinqs.com/threat/TL-2026-1621) — high — 2026-07-22 - [CrashStealer: Novel macOS Information Stealer Disguised as Apple Crash Reporter (Jamf Threat Labs)](https://intel.threadlinqs.com/threat/TL-2026-1470) — medium — 2026-07-18 - [ClickLock Stealer: macOS ClickFix Infostealer Uses 210ms Process-Kill Loops and Fake Authentication Dialogs…](https://intel.threadlinqs.com/threat/TL-2026-1440) — high — 2026-07-17 - [ClickLock Stealer: ClickFix-Delivered macOS Infostealer with GSocket Reverse-Shell Backdoor](https://intel.threadlinqs.com/threat/TL-2026-1402) — high — 2026-07-16 - [CrashStealer: Notarized Fake Apple CrashReporter App Steals macOS Keychain, Browser, and Crypto Wallet…](https://intel.threadlinqs.com/threat/TL-2026-1358) — high — 2026-07-15 - [Callback Phishing Campaign Impersonates Robinhood With Fake Sign-In Alerts (LevelBlue SpiderLabs)](https://intel.threadlinqs.com/threat/TL-2026-1171) — high — 2026-07-10 - [PamStealer: Rust-Based macOS Infostealer Masquerades as Maccy Clipboard Manager, Validates Stolen Passwords…](https://intel.threadlinqs.com/threat/TL-2026-1104) — high — 2026-07-05 - [Verified X Ad Spreads Mac Infostealer (Atomic Stealer Variant "MacSync"/DigitStealer) via Fake DynamicLake…](https://intel.threadlinqs.com/threat/TL-2026-1095) — high — 2026-07-03 - [Ousaban Banking Trojan (Tetrade/Javali) Targets Iberian Banks via Phishing PDFs, Fake Tax Portal, and…](https://intel.threadlinqs.com/threat/TL-2026-1079) — high — 2026-07-02 - [Mistic Backdoor (MLTBackdoor) Impersonates Microsoft Endpoint Security via DLL Sideloading…](https://intel.threadlinqs.com/threat/TL-2026-1038) — high — 2026-07-01 - [Backdoor.Mistic (MLTBackdoor): New Stealth Backdoor Linked to Woodgnat Ransomware Access Broker](https://intel.threadlinqs.com/threat/TL-2026-2277) — high — 2026-06-24 - [Backdoor.Mistic (MLTBackdoor) — In-Memory BOF-Capable Backdoor Deployed by Woodgnat/KongTuke IAB Alongside…](https://intel.threadlinqs.com/threat/TL-2026-0933) — high — 2026-06-24 - [macOS ClickFix Campaign Silently Mounts Malicious DMGs (hdiutil attach -nobrowse) to Deploy Atomic macOS…](https://intel.threadlinqs.com/threat/TL-2026-0923) — high — 2026-06-23 - [Meow Mac Stealer RAT: macOS ClickFix Lures Deploy AppleScript Infostealer with Persistent RAT Capabilities](https://intel.threadlinqs.com/threat/TL-2026-0842) — high — 2026-06-17 - [Internet Explorer WebBrowser Control Attack Chain — Two-Click RCE via Zone/MOTW Bypass and ActiveX COM…](https://intel.threadlinqs.com/threat/TL-2026-0715) — high — 2026-06-08 - [Grandoreiro Banking Trojan Resurgence (May 2026) — Dual-Vector DLL Side-Loading & VBS Geofenced Campaign…](https://intel.threadlinqs.com/threat/TL-2026-0609) — high — 2026-05-27 - [SHADOW-WATER-063 Banana RAT — Brazilian Banking Trojan with FastAPI Polymorphism Panel, AES-256-CBC…](https://intel.threadlinqs.com/threat/TL-2026-0534) — high — 2026-05-19 - [Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign — DLL Sideloading via Signed Fortemedia and…](https://intel.threadlinqs.com/threat/TL-2026-0500) — high — 2026-05-12 ## Detection coverage Threadlinqs maintains 72 detection rules mapped to T1056.002 (SPL 24, KQL 28, Sigma 20). Rule content is available to Blue tier accounts and above; this page shows counts only. 72 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1056 Input Capture](https://intel.threadlinqs.com/technique/T1056) — 285 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1056.002 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)