Activity timeline
T1417.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-09 with 7 reports, and 18 of the 18 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1417.002 GUI Input Capture is catalogued by MITRE ATT&CK under the Credential Access (Mobile) and Collection (Mobile) tactics in the Mobile matrix, as a sub-technique of T1417 Input Capture. Threadlinqs maps 18 of 2623 tracked threats (0.7%) to it; by severity that is 1 critical, 17 high.
Threats that use T1417.002 most often also use T1660 Phishing (15 threats), T1418 Software Discovery (14 threats), T1513 Screen Capture (14 threats), T1516 Input Injection (12 threats), T1541 Foreground Persistence (11 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
3 tracked threat actors appear in the threats that use T1417.002; the most frequent are Cyber Av3ngers (1), Interlock (1), SHADOW-EARTH-053 (1).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1417.002.
Threat actors using it
Tracked threats
18 tracked threats use T1417.002.
- RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritizationhigh
- RemControl Android Banking Trojan Targets Italy and France via Fake TVTap IPTV Apphigh
- RatHat: AI-Powered Android Banking Trojan Abuses Accessibility Service and ADB to Steal Credentials, PINs…high
- Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)high
- Mantax Otax: Indonesian Android Malware Combines Ransomware with Spyware Integrationhigh
- StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTokhigh
- Recorded Future H1 2026 Report: Actively Exploited CVEs Up 34%, Ransomware Adopts BYOVD and Post-Quantum…high
- ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countrieshigh
- Banking Trojans: Manic, Grandoreiro, and ToxicPanda 2.0 in the Spotlighthigh
- Copybara Android RAT Delivered via Fake N26 Support Vishing Callshigh
- ThreatsDay Bulletin: Iran-Linked CyberAv3ngers PLC Intrusion Campaign (AA26-097A) and OctagonPanel/Ward RAT…high
- "BH Alert" Fake Bahrain Civil Defense App Deploys Four-Stage OctagonPanel Android Surveillance Platformhigh
- RedHook Android RAT Abuses Wireless ADB via Accessibility Service to Gain Shell-Level Device Accesshigh
- Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Playhigh
- Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commandshigh
- OverlayPhantom Android Banking Trojan — Novel Overlay-Driven Credential Theft Targeting 180+ Banking and…critical
- PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote…high
- ZeroDayRAT Commercial Mobile Spyware — Telegram-Sold Cross-Platform Android/iOS Surveillance, Live…high
Detection coverage
Threadlinqs maintains 44 detection rules mapped to T1417.002 (SPL 15, KQL 17, Sigma 12). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1417 Input Capture — 31 tracked threats at the technique level.