Activity timeline
T1429 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 7 reports, and 24 of the 24 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1429 Audio Capture is catalogued by MITRE ATT&CK under the Collection (Mobile) tactic in the Mobile matrix. Threadlinqs maps 24 of 2623 tracked threats (0.9%) to it; by severity that is 2 critical, 20 high, 1 medium.
Threats that use T1429 most often also use T1430 Location Tracking (20 threats), T1426 System Information Discovery (19 threats), T1513 Screen Capture (15 threats), T1646 Exfiltration Over C2 Channel (15 threats), T1660 Phishing (15 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
3 tracked threat actors appear in the threats that use T1429; the most frequent are NSO Group (3), Intellexa Consortium (2), APT37 (1).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1429.
Threat actors using it
Tracked threats
24 tracked threats use T1429.
- RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritizationhigh
- Mantax Otax: Indonesian Android Malware Combines Ransomware with Spyware Integrationhigh
- Pegasus Spyware Used to Hack Phone of Former MEP Stelios Kouloglou, PEGA Committee Memberhigh
- Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…high
- Apple Issues Mercenary Spyware Threat Notifications to Users in 110 Countrieshigh
- Apple Expands On-Device Lock Screen Alerts for Mercenary Spyware Targetshigh
- Octagon Android RAT — Fake Bahrain Civil Defense App Targets Mobile Endpoints via Multi-Stage Payloadcritical
- Inside the Underground Business of the BTMOB Android RAT Malware-as-a-Servicehigh
- Copybara Android RAT Delivered via Fake N26 Support Vishing Callshigh
- Flying Eagle Android RAT: Leaked Source Code Powers 170 Active C2 Servers, Successor "Night Dragon" Emergeshigh
- NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions…
- UK Supreme Court Rejects Bahrain's State Immunity Claim in FinSpy/FinFisher Spyware Surveillance Case…medium
- RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutionshigh
- Glitch SPY Android RAT Distributed via Fake Polish Rental App ("Tutaj Dom") Using Brokewell Loaderhigh
- Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committeecritical
- Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…high
- Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…high
- NSO Group Pegasus Spyware — WhatsApp Spearphishing Campaign Alleged in Meta Contempt Complaint (June 2026)high
- BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…high
- ScarCruft (APT37) BirdCall Android Variant — Multiplatform Supply-Chain Attack via sqgame[.]com[.]cn…high
- Predator Spyware: Undocumented iOS Kernel Exploitation Engine (FDGuardNeonRW, PAC Bypass, RWTransfer)high
- ResidentBat — Belarusian KGB Android Spyware at Internet Scale (ADB Sideloading, Custom HTTPS C2, Journalist…high
- SURXRAT Android RAT — LLM Module Downloads from Hugging Face, MaaS via Telegram, ArsinkRAT Evolutionhigh
- ZeroDayRAT Commercial Mobile Spyware — Telegram-Sold Cross-Platform Android/iOS Surveillance, Live…high
Detection coverage
Threadlinqs maintains 27 detection rules mapped to T1429 (SPL 8, KQL 8, Sigma 11). Rule content is available to Blue tier accounts and above; this page shows counts only.