# T1417.001 Keylogging > As of 2026-10-05, T1417.001 (Keylogging) appears in 12 tracked threats, first reported 2026-02-16 and most recently 2026-09-28, with linked actors including Balonx; it most often appears alongside T1513 (Screen Capture). - **Tracked threats:** 12 (1 critical, 11 high) - **First seen:** 2026-02-16 - **Last seen:** 2026-09-28 - **Threat actors:** 1 - **Detection rules:** 35 (counts only; Blue tier and above) ## Key facts - **ID:** T1417.001 - **Framework:** MITRE ATT&CK - **Tactics:** Collection (Mobile), Credential Access (Mobile) - **Matrix:** Mobile - **Parent:** T1417 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1417/001/ ## Activity timeline T1417.001 first appeared in tracked threats on 2026-02-16 and was most recently reported on 2026-09-28. The busiest month was 2026-09 with 5 reports, and 12 of the 12 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1417.001 Keylogging is catalogued by MITRE ATT&CK under the Collection (Mobile) and Credential Access (Mobile) tactics in the Mobile matrix, as a sub-technique of [T1417 Input Capture](https://intel.threadlinqs.com/technique/T1417). Threadlinqs maps 12 of 2623 tracked threats (0.5%) to it; by severity that is 1 critical, 11 high. Threats that use T1417.001 most often also use [T1513 Screen Capture](https://intel.threadlinqs.com/technique/T1513) (10 threats), [T1660 Phishing](https://intel.threadlinqs.com/technique/T1660) (10 threats), [T1417.002 GUI Input Capture](https://intel.threadlinqs.com/technique/T1417.002) (9 threats), [T1418 Software Discovery](https://intel.threadlinqs.com/technique/T1418) (8 threats), [T1516 Input Injection](https://intel.threadlinqs.com/technique/T1516) (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 1 tracked threat actor appear in the threats that use T1417.001; the most frequent are [Balonx](https://intel.threadlinqs.com/actor/Balonx) (1). ## Mitigations MITRE ATT&CK lists 2 mitigations for T1417.001. - [M1011 User Guidance](https://attack.mitre.org/mitigations/M1011/) - [M1012 Enterprise Policy](https://attack.mitre.org/mitigations/M1012/) ## Threat actors using it - [Balonx](https://intel.threadlinqs.com/actor/Balonx) — 1 ## Tracked threats 12 tracked threats use T1417.001. - [RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritization](https://intel.threadlinqs.com/threat/TL-2026-2743) — high — 2026-09-28 - [RemControl Android Banking Trojan Targets Italy and France via Fake TVTap IPTV App](https://intel.threadlinqs.com/threat/TL-2026-2625) — high — 2026-09-23 - [Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)](https://intel.threadlinqs.com/threat/TL-2026-2444) — high — 2026-09-11 - [StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTok](https://intel.threadlinqs.com/threat/TL-2026-2312) — high — 2026-09-03 - [Chinese-Speaking Threat Actors Deploy PanDa Android RAT Against Mexican Banking Users via Meta Ads…](https://intel.threadlinqs.com/threat/TL-2026-2279) — high — 2026-09-01 - [Balonx Sistema: Mexican Phishing-as-a-Service Platform Combines Real-Time MITM, Android RAT, and AI Vishing…](https://intel.threadlinqs.com/threat/TL-2026-2143) — critical — 2026-08-25 - [ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countries](https://intel.threadlinqs.com/threat/TL-2026-2128) — high — 2026-08-24 - [Banking Trojans: Manic, Grandoreiro, and ToxicPanda 2.0 in the Spotlight](https://intel.threadlinqs.com/threat/TL-2026-2118) — high — 2026-08-22 - [Copybara Android RAT Delivered via Fake N26 Support Vishing Calls](https://intel.threadlinqs.com/threat/TL-2026-1804) — high — 2026-08-01 - [Turkish Banking & Government-Portal Fraud Ecosystem: 8,400+ Phishing Domains, 6,700+ e-Devlet Lookalikes…](https://intel.threadlinqs.com/threat/TL-2026-1313) — high — 2026-07-14 - [PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote…](https://intel.threadlinqs.com/threat/TL-2026-0135) — high — 2026-02-23 - [ZeroDayRAT Commercial Mobile Spyware — Telegram-Sold Cross-Platform Android/iOS Surveillance, Live…](https://intel.threadlinqs.com/threat/TL-2026-0116) — high — 2026-02-16 ## Detection coverage Threadlinqs maintains 35 detection rules mapped to T1417.001 (SPL 12, KQL 14, Sigma 9). Rule content is available to Blue tier accounts and above; this page shows counts only. 35 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1417 Input Capture](https://intel.threadlinqs.com/technique/T1417) — 31 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1417.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)