# T1417 Input Capture

> As of 2026-10-05, T1417 (Input Capture) appears in 31 tracked threats, first reported 2026-03-07 and most recently 2026-09-25, with linked actors including NSO Group, APT44, Cyber Av3ngers; it most often appears alongside T1437 (Application Layer Protocol).

- **Tracked threats:** 31 (2 critical, 25 high, 3 medium, 1 low)
- **First seen:** 2026-03-07
- **Last seen:** 2026-09-25
- **Threat actors:** 3
- **Detection rules:** 26 (counts only; Blue tier and above)

## Key facts

- **ID:** T1417
- **Framework:** MITRE ATT&CK
- **Tactics:** Collection (Mobile), Credential Access (Mobile)
- **Matrix:** Mobile
- **Data as of:** 2026-10-05
- **MITRE:** https://attack.mitre.org/techniques/T1417/

## Activity timeline

T1417 first appeared in tracked threats on 2026-03-07 and was most recently reported on 2026-09-25. The busiest month was 2026-07 with 15 reports, and 31 of the 31 threats were reported in the twelve months to 2026-09.

## How adversaries use it

T1417 Input Capture is catalogued by MITRE ATT&CK under the Collection (Mobile) and Credential Access (Mobile) tactics in the Mobile matrix. Threadlinqs maps 31 of 2623 tracked threats (1.2%) to it; by severity that is 2 critical, 25 high, 3 medium, 1 low.

Threats that use T1417 most often also use [T1437 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1437) (22 threats), [T1660 Phishing](https://intel.threadlinqs.com/technique/T1660) (22 threats), [T1646 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1646) (20 threats), [T1418 Software Discovery](https://intel.threadlinqs.com/technique/T1418) (18 threats), [T1426 System Information Discovery](https://intel.threadlinqs.com/technique/T1426) (18 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

3 tracked threat actors appear in the threats that use T1417; the most frequent are [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) (2), [APT44](https://intel.threadlinqs.com/actor/APT44) (1), [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) (1).

## Mitigations

MITRE ATT&CK lists 3 mitigations for T1417.

- [M1006 Use Recent OS Version](https://attack.mitre.org/mitigations/M1006/)
- [M1011 User Guidance](https://attack.mitre.org/mitigations/M1011/)
- [M1012 Enterprise Policy](https://attack.mitre.org/mitigations/M1012/)

## Threat actors using it

- [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) — 2
- [APT44](https://intel.threadlinqs.com/actor/APT44) — 1
- [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) — 1

## Tracked threats

The 30 most recent of 31 tracked threats that use T1417.

- [Deceptive Android Apps Exploit Google Play Early Access to Reach Mobile Users](https://intel.threadlinqs.com/threat/TL-2026-2655) — medium — 2026-09-25
- [Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…](https://intel.threadlinqs.com/threat/TL-2026-2316) — high — 2026-09-03
- [StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTok](https://intel.threadlinqs.com/threat/TL-2026-2312) — high — 2026-09-03
- [Apple Issues Mercenary Spyware Threat Notifications to Users in 110 Countries](https://intel.threadlinqs.com/threat/TL-2026-2034) — high — 2026-08-16
- [WindRelay + SpyNote Combo: NFC Relay Malware Enables Contactless Card Fraud Across Central/Eastern Europe](https://intel.threadlinqs.com/threat/TL-2026-1995) — high — 2026-08-12
- [Octagon Android RAT — Fake Bahrain Civil Defense App Targets Mobile Endpoints via Multi-Stage Payload](https://intel.threadlinqs.com/threat/TL-2026-1881) — critical — 2026-08-05
- [Inside the Underground Business of the BTMOB Android RAT Malware-as-a-Service](https://intel.threadlinqs.com/threat/TL-2026-1841) — high — 2026-08-03
- [Octagon / OctagonPanel "Ward" Android RAT Impersonates Bahrain's "BH Alert" Civil Defense App to Steal…](https://intel.threadlinqs.com/threat/TL-2026-1832) — high — 2026-08-03
- [ESET H1 2026 Threat Report: Malicious AI Agent Skills Surge Fivefold to 3,000+ Entries; PromptSpy Debuts as…](https://intel.threadlinqs.com/threat/TL-2026-1798) — medium — 2026-07-31
- [Tax Season Phishing and Malware Campaign Targets Indian Taxpayers via Fake Income Tax Department Notices](https://intel.threadlinqs.com/threat/TL-2026-1769) — high — 2026-07-30
- [Flying Eagle Android RAT: Leaked Source Code Powers 170 Active C2 Servers, Successor "Night Dragon" Emerges](https://intel.threadlinqs.com/threat/TL-2026-1757) — high — 2026-07-29
- [Research: Android ML Malware Detectors Collapse Without Context-Stage Analysis (PRAXIS vs. Drebin, MalScan…](https://intel.threadlinqs.com/threat/TL-2026-1753) — low — 2026-07-29
- [Albiriox Android Banking RAT-as-a-Service and the Barcode Scanner Play Store Supply-Chain Compromise…](https://intel.threadlinqs.com/threat/TL-2026-1667) — medium — 2026-07-24
- [ThreatsDay Bulletin: Iran-Linked CyberAv3ngers PLC Intrusion Campaign (AA26-097A) and OctagonPanel/Ward RAT…](https://intel.threadlinqs.com/threat/TL-2026-1659) — high — 2026-07-23
- ["BH Alert" Fake Bahrain Civil Defense App Deploys Four-Stage OctagonPanel Android Surveillance Platform](https://intel.threadlinqs.com/threat/TL-2026-1636) — high — 2026-07-22
- [UAC-0145 (Sandworm/APT44, GRU) Uses ClickFix Fake-CAPTCHA Lures and EtherHiding to Deploy Multi-Stage…](https://intel.threadlinqs.com/threat/TL-2026-1527) — high — 2026-07-19
- [RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutions](https://intel.threadlinqs.com/threat/TL-2026-1478) — high — 2026-07-18
- [RedHook Android RAT Abuses Wireless ADB via Accessibility Service to Gain Shell-Level Device Access](https://intel.threadlinqs.com/threat/TL-2026-1248) — high — 2026-07-12
- [Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…](https://intel.threadlinqs.com/threat/TL-2026-1225) — high — 2026-07-11
- [Glitch SPY Android RAT Distributed via Fake Polish Rental App ("Tutaj Dom") Using Brokewell Loader](https://intel.threadlinqs.com/threat/TL-2026-1195) — high — 2026-07-10
- [European Parliament Member Investigating Pegasus Spyware Hacked With Pegasus (PWNYOURHOME Zero-Click Exploit…](https://intel.threadlinqs.com/threat/TL-2026-1099) — critical — 2026-07-03
- [Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…](https://intel.threadlinqs.com/threat/TL-2026-1098) — high — 2026-07-03
- [Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Play](https://intel.threadlinqs.com/threat/TL-2026-1059) — high — 2026-07-02
- [Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commands](https://intel.threadlinqs.com/threat/TL-2026-0826) — high — 2026-06-16
- [Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…](https://intel.threadlinqs.com/threat/TL-2026-0751) — high — 2026-06-10
- [NSO Group Pegasus Spyware — WhatsApp Spearphishing Campaign Alleged in Meta Contempt Complaint (June 2026)](https://intel.threadlinqs.com/threat/TL-2026-0728) — high — 2026-06-09
- [BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…](https://intel.threadlinqs.com/threat/TL-2026-0600) — high — 2026-05-27
- [TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL for Covert C2 Targeting Banking and Crypto Users…](https://intel.threadlinqs.com/threat/TL-2026-0494) — high — 2026-05-11
- [NGate Android NFC Relay Malware Variant - Trojanized HandyPay Banking App Campaign Targeting Brazil…](https://intel.threadlinqs.com/threat/TL-2026-0407) — high — 2026-04-22
- [NGate Android Malware — HandyPay-Trojanized NFC Relay Variant Targets Brazilian Cardholders via Fake Rio de…](https://intel.threadlinqs.com/threat/TL-2026-0401) — high — 2026-04-21

## Related CVEs

CVEs referenced by the tracked threats that use T1417, most frequent first.

- [CVE-2021-30860](https://intel.threadlinqs.com/cve/CVE-2021-30860)
- [CVE-2023-41061](https://intel.threadlinqs.com/cve/CVE-2023-41061)
- [CVE-2023-41064](https://intel.threadlinqs.com/cve/CVE-2023-41064)
- [CVE-2016-4655](https://intel.threadlinqs.com/cve/CVE-2016-4655)
- [CVE-2016-4656](https://intel.threadlinqs.com/cve/CVE-2016-4656)
- [CVE-2016-4657](https://intel.threadlinqs.com/cve/CVE-2016-4657)
- [CVE-2019-3568](https://intel.threadlinqs.com/cve/CVE-2019-3568)
- [CVE-2024-43047](https://intel.threadlinqs.com/cve/CVE-2024-43047)
- [CVE-2024-50302](https://intel.threadlinqs.com/cve/CVE-2024-50302)
- [CVE-2024-53104](https://intel.threadlinqs.com/cve/CVE-2024-53104)
- [CVE-2024-53197](https://intel.threadlinqs.com/cve/CVE-2024-53197)
- [CVE-2025-31200](https://intel.threadlinqs.com/cve/CVE-2025-31200)
- [CVE-2025-31201](https://intel.threadlinqs.com/cve/CVE-2025-31201)

## Detection coverage

Threadlinqs maintains 26 detection rules mapped to T1417 (SPL 7, KQL 10, Sigma 9). Rule content is available to Blue tier accounts and above; this page shows counts only.

26 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing

## Sub-techniques

- [T1417.001 Keylogging](https://intel.threadlinqs.com/technique/T1417.001) — 12 tracked threats
- [T1417.002 GUI Input Capture](https://intel.threadlinqs.com/technique/T1417.002) — 18 tracked threats

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1417
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)