Activity timeline
T1414 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 7 reports, and 16 of the 16 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1414 Clipboard Data is catalogued by MITRE ATT&CK under the Collection (Mobile) and Credential Access (Mobile) tactics in the Mobile matrix. Threadlinqs maps 16 of 2623 tracked threats (0.6%) to it; by severity that is 4 critical, 10 high, 2 medium.
Threats that use T1414 most often also use T1426 System Information Discovery (14 threats), T1646 Exfiltration Over C2 Channel (13 threats), T1437 Application Layer Protocol (11 threats), T1418 Software Discovery (10 threats), T1417 Input Capture (9 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
1 tracked threat actor appear in the threats that use T1414; the most frequent are MoYu Group (1).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1414.
Threat actors using it
Tracked threats
16 tracked threats use T1414.
- FomoPeek iOS App Store Poisoning: Kernel Exploit Framework Steals Crypto Private Keys via Keychain Decryptioncritical
- JarService/Zhima Multi-Stage Android Malware Targets DoFun Automotive Head Units, Linked to BADBOX Botnethigh
- Inside the Underground Business of the BTMOB Android RAT Malware-as-a-Servicehigh
- Copybara Android RAT Delivered via Fake N26 Support Vishing Callshigh
- Albiriox Android Banking RAT-as-a-Service and the Barcode Scanner Play Store Supply-Chain Compromise…medium
- Gemini CLI Abused as Autonomous AI Hacking Agent to Build and Operate "Patriot Bait" (bandcampro) C2 Botnet…medium
- Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…high
- Glitch SPY Android RAT Distributed via Fake Polish Rental App ("Tutaj Dom") Using Brokewell Loaderhigh
- Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committeecritical
- European Parliament Member Investigating Pegasus Spyware Hacked With Pegasus (PWNYOURHOME Zero-Click Exploit…critical
- Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…high
- Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commandshigh
- BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…high
- OverlayPhantom Android Banking Trojan — Novel Overlay-Driven Credential Theft Targeting 180+ Banking and…critical
- TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL for Covert C2 Targeting Banking and Crypto Users…high
- SURXRAT Android RAT — LLM Module Downloads from Hugging Face, MaaS via Telegram, ArsinkRAT Evolutionhigh
Detection coverage
Threadlinqs maintains 8 detection rules mapped to T1414 (KQL 6, Sigma 2). Rule content is available to Blue tier accounts and above; this page shows counts only.