Activity timeline
T1512 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 7 reports, and 20 of the 20 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1512 Video Capture is catalogued by MITRE ATT&CK under the Collection (Mobile) tactic in the Mobile matrix. Threadlinqs maps 20 of 2623 tracked threats (0.8%) to it; by severity that is 1 critical, 15 high, 3 medium.
Threats that use T1512 most often also use T1426 System Information Discovery (14 threats), T1429 Audio Capture (14 threats), T1430 Location Tracking (14 threats), T1660 Phishing (14 threats), T1541 Foreground Persistence (12 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
2 tracked threat actors appear in the threats that use T1512; the most frequent are Intellexa Consortium (2), NSO Group (2).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1512.
Threat actors using it
Tracked threats
20 tracked threats use T1512.
- RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritizationhigh
- Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…high
- ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countrieshigh
- Banking Trojans: Manic, Grandoreiro, and ToxicPanda 2.0 in the Spotlighthigh
- Apple Issues Mercenary Spyware Threat Notifications to Users in 110 Countrieshigh
- Apple Expands On-Device Lock Screen Alerts for Mercenary Spyware Targetshigh
- Copybara Android RAT Delivered via Fake N26 Support Vishing Callshigh
- ESET H1 2026 Threat Report: Malicious AI Agent Skills Surge Fivefold to 3,000+ Entries; PromptSpy Debuts as…medium
- Flying Eagle Android RAT: Leaked Source Code Powers 170 Active C2 Servers, Successor "Night Dragon" Emergeshigh
- NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions…
- Albiriox Android Banking RAT-as-a-Service and the Barcode Scanner Play Store Supply-Chain Compromise…medium
- RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutionshigh
- Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committeecritical
- Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…high
- Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…high
- BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…high
- Predator Spyware: Undocumented iOS Kernel Exploitation Engine (FDGuardNeonRW, PAC Bypass, RWTransfer)high
- Large-Scale Scam and Impersonation Campaign Targeting Commercial Airline Industry (11,600+ Malicious…medium
- PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote…high
- ZeroDayRAT Commercial Mobile Spyware — Telegram-Sold Cross-Platform Android/iOS Surveillance, Live…high
Detection coverage
Threadlinqs maintains 23 detection rules mapped to T1512 (SPL 6, KQL 10, Sigma 7). Rule content is available to Blue tier accounts and above; this page shows counts only.