T1406.002 Software Packing

Activity timeline

T1406.002 first appeared in tracked threats on 2026-02-23 and was most recently reported on 2026-10-21. The busiest month was 2026-10 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1406.002 Software Packing is catalogued by MITRE ATT&CK under the Defense Evasion (Mobile) tactic in the Mobile matrix, as a sub-technique of T1406 Obfuscated Files or Information. Threadlinqs maps 10 of 3302 tracked threats (0.3%) to it; by severity that is 9 high, 1 medium.

Threats that use T1406.002 most often also use T1660 Phishing (9 threats), T1417.002 GUI Input Capture (8 threats), T1418 Software Discovery (8 threats), T1516 Input Injection (8 threats), T1417.001 Keylogging (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

1 tracked threat actor appear in the threats that use T1406.002; the most frequent are GoldFactory (1).

Threat actors using it

• GoldFactory 1

Tracked threats

10 tracked threats use T1406.002.

• GoldFactory Android/iOS banking trojan campaign impersonating tax officers across Indonesia, Thailand and…high2026-10-21
• GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI PINs via Fake Traffic Challan / mParivahan SMS…high2026-10-15
• Novinarya: Android stealer hiding its live C2 in a basalam.com shop profile biohigh2026-10-09
• Crypter-as-a-Service Obfuscation Enabling Undetectable Android/Mobile Malware (ASD-led Advisory "Digital…high2026-10-07
• RemControl Android Banking Trojan Targets Italy and France via Fake TVTap IPTV Apphigh2026-09-23
• RatHat: AI-Powered Android Banking Trojan Abuses Accessibility Service and ADB to Steal Credentials, PINs…high2026-09-20
• Chinese-Speaking Threat Actors Deploy PanDa Android RAT Against Mexican Banking Users via Meta Ads…high2026-09-01
• Copybara Android RAT Delivered via Fake N26 Support Vishing Callshigh2026-08-01
• Android.MagicAd Trojan Floods Devices with Ads via Xiaomi GetApps, Samsung Galaxy Store, and Preinstalled…medium2026-06-09
• PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote…high2026-02-23

Detection coverage

Threadlinqs maintains 12 detection rules mapped to T1406.002 (SPL 2, KQL 5, Sigma 5). Rule content is available to Blue tier accounts and above; this page shows counts only.

Parent technique

T1406 Obfuscated Files or Information — 34 tracked threats at the technique level.