# T1406.002 Software Packing > As of 2026-10-28, T1406.002 (Software Packing) appears in 10 tracked threats, first reported 2026-02-23 and most recently 2026-10-21, with linked actors including GoldFactory; it most often appears alongside T1660 (Phishing). - **Tracked threats:** 10 (9 high, 1 medium) - **First seen:** 2026-02-23 - **Last seen:** 2026-10-21 - **Threat actors:** 1 - **Detection rules:** 12 (counts only; Blue tier and above) ## Key facts - **ID:** T1406.002 - **Framework:** MITRE ATT&CK - **Tactics:** Defense Evasion (Mobile) - **Matrix:** Mobile - **Parent:** T1406 - **Data as of:** 2026-10-28 - **MITRE:** https://attack.mitre.org/techniques/T1406/002/ ## Activity timeline T1406.002 first appeared in tracked threats on 2026-02-23 and was most recently reported on 2026-10-21. The busiest month was 2026-10 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1406.002 Software Packing is catalogued by MITRE ATT&CK under the Defense Evasion (Mobile) tactic in the Mobile matrix, as a sub-technique of [T1406 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1406). Threadlinqs maps 10 of 3302 tracked threats (0.3%) to it; by severity that is 9 high, 1 medium. Threats that use T1406.002 most often also use [T1660 Phishing](https://intel.threadlinqs.com/technique/T1660) (9 threats), [T1417.002 GUI Input Capture](https://intel.threadlinqs.com/technique/T1417.002) (8 threats), [T1418 Software Discovery](https://intel.threadlinqs.com/technique/T1418) (8 threats), [T1516 Input Injection](https://intel.threadlinqs.com/technique/T1516) (8 threats), [T1417.001 Keylogging](https://intel.threadlinqs.com/technique/T1417.001) (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 1 tracked threat actor appear in the threats that use T1406.002; the most frequent are [GoldFactory](https://intel.threadlinqs.com/actor/GoldFactory) (1). ## Threat actors using it - [GoldFactory](https://intel.threadlinqs.com/actor/GoldFactory) — 1 ## Tracked threats 10 tracked threats use T1406.002. - [GoldFactory Android/iOS banking trojan campaign impersonating tax officers across Indonesia, Thailand and…](https://intel.threadlinqs.com/threat/TL-2026-4025) — high — 2026-10-21 - [GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI PINs via Fake Traffic Challan / mParivahan SMS…](https://intel.threadlinqs.com/threat/TL-2026-3676) — high — 2026-10-15 - [Novinarya: Android stealer hiding its live C2 in a basalam.com shop profile bio](https://intel.threadlinqs.com/threat/TL-2026-3128) — high — 2026-10-09 - [Crypter-as-a-Service Obfuscation Enabling Undetectable Android/Mobile Malware (ASD-led Advisory "Digital…](https://intel.threadlinqs.com/threat/TL-2026-3033) — high — 2026-10-07 - [RemControl Android Banking Trojan Targets Italy and France via Fake TVTap IPTV App](https://intel.threadlinqs.com/threat/TL-2026-2625) — high — 2026-09-23 - [RatHat: AI-Powered Android Banking Trojan Abuses Accessibility Service and ADB to Steal Credentials, PINs…](https://intel.threadlinqs.com/threat/TL-2026-2592) — high — 2026-09-20 - [Chinese-Speaking Threat Actors Deploy PanDa Android RAT Against Mexican Banking Users via Meta Ads…](https://intel.threadlinqs.com/threat/TL-2026-2279) — high — 2026-09-01 - [Copybara Android RAT Delivered via Fake N26 Support Vishing Calls](https://intel.threadlinqs.com/threat/TL-2026-1804) — high — 2026-08-01 - [Android.MagicAd Trojan Floods Devices with Ads via Xiaomi GetApps, Samsung Galaxy Store, and Preinstalled…](https://intel.threadlinqs.com/threat/TL-2026-0737) — medium — 2026-06-09 - [PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote…](https://intel.threadlinqs.com/threat/TL-2026-0135) — high — 2026-02-23 ## Detection coverage Threadlinqs maintains 12 detection rules mapped to T1406.002 (SPL 2, KQL 5, Sigma 5). Rule content is available to Blue tier accounts and above; this page shows counts only. 12 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1406 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1406) — 34 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1406.002 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)