# T1512 Video Capture > As of 2026-10-05, T1512 (Video Capture) appears in 20 tracked threats, first reported 2026-02-16 and most recently 2026-09-28, with linked actors including Intellexa Consortium, NSO Group; it most often appears alongside T1426 (System Information Discovery). - **Tracked threats:** 20 (1 critical, 15 high, 3 medium) - **First seen:** 2026-02-16 - **Last seen:** 2026-09-28 - **Threat actors:** 2 - **Detection rules:** 23 (counts only; Blue tier and above) ## Key facts - **ID:** T1512 - **Framework:** MITRE ATT&CK - **Tactics:** Collection (Mobile) - **Matrix:** Mobile - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1512/ ## Activity timeline T1512 first appeared in tracked threats on 2026-02-16 and was most recently reported on 2026-09-28. The busiest month was 2026-07 with 7 reports, and 20 of the 20 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1512 Video Capture is catalogued by MITRE ATT&CK under the Collection (Mobile) tactic in the Mobile matrix. Threadlinqs maps 20 of 2623 tracked threats (0.8%) to it; by severity that is 1 critical, 15 high, 3 medium. Threats that use T1512 most often also use [T1426 System Information Discovery](https://intel.threadlinqs.com/technique/T1426) (14 threats), [T1429 Audio Capture](https://intel.threadlinqs.com/technique/T1429) (14 threats), [T1430 Location Tracking](https://intel.threadlinqs.com/technique/T1430) (14 threats), [T1660 Phishing](https://intel.threadlinqs.com/technique/T1660) (14 threats), [T1541 Foreground Persistence](https://intel.threadlinqs.com/technique/T1541) (12 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 2 tracked threat actors appear in the threats that use T1512; the most frequent are [Intellexa Consortium](https://intel.threadlinqs.com/actor/Intellexa%20Consortium) (2), [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) (2). ## Mitigations MITRE ATT&CK lists 1 mitigation for T1512. - [M1006 Use Recent OS Version](https://attack.mitre.org/mitigations/M1006/) ## Threat actors using it - [Intellexa Consortium](https://intel.threadlinqs.com/actor/Intellexa%20Consortium) — 2 - [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) — 2 ## Tracked threats 20 tracked threats use T1512. - [RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritization](https://intel.threadlinqs.com/threat/TL-2026-2743) — high — 2026-09-28 - [Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…](https://intel.threadlinqs.com/threat/TL-2026-2316) — high — 2026-09-03 - [ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countries](https://intel.threadlinqs.com/threat/TL-2026-2128) — high — 2026-08-24 - [Banking Trojans: Manic, Grandoreiro, and ToxicPanda 2.0 in the Spotlight](https://intel.threadlinqs.com/threat/TL-2026-2118) — high — 2026-08-22 - [Apple Issues Mercenary Spyware Threat Notifications to Users in 110 Countries](https://intel.threadlinqs.com/threat/TL-2026-2034) — high — 2026-08-16 - [Apple Expands On-Device Lock Screen Alerts for Mercenary Spyware Targets](https://intel.threadlinqs.com/threat/TL-2026-2016) — high — 2026-08-14 - [Copybara Android RAT Delivered via Fake N26 Support Vishing Calls](https://intel.threadlinqs.com/threat/TL-2026-1804) — high — 2026-08-01 - [ESET H1 2026 Threat Report: Malicious AI Agent Skills Surge Fivefold to 3,000+ Entries; PromptSpy Debuts as…](https://intel.threadlinqs.com/threat/TL-2026-1798) — medium — 2026-07-31 - [Flying Eagle Android RAT: Leaked Source Code Powers 170 Active C2 Servers, Successor "Night Dragon" Emerges](https://intel.threadlinqs.com/threat/TL-2026-1757) — high — 2026-07-29 - [NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions…](https://intel.threadlinqs.com/threat/TL-2026-1748) — 2026-07-28 - [Albiriox Android Banking RAT-as-a-Service and the Barcode Scanner Play Store Supply-Chain Compromise…](https://intel.threadlinqs.com/threat/TL-2026-1667) — medium — 2026-07-24 - [RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutions](https://intel.threadlinqs.com/threat/TL-2026-1478) — high — 2026-07-18 - [Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committee](https://intel.threadlinqs.com/threat/TL-2026-1110) — critical — 2026-07-05 - [Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…](https://intel.threadlinqs.com/threat/TL-2026-1098) — high — 2026-07-03 - [Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…](https://intel.threadlinqs.com/threat/TL-2026-0751) — high — 2026-06-10 - [BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…](https://intel.threadlinqs.com/threat/TL-2026-0600) — high — 2026-05-27 - [Predator Spyware: Undocumented iOS Kernel Exploitation Engine (FDGuardNeonRW, PAC Bypass, RWTransfer)](https://intel.threadlinqs.com/threat/TL-2026-2046) — high — 2026-04-10 - [Large-Scale Scam and Impersonation Campaign Targeting Commercial Airline Industry (11,600+ Malicious…](https://intel.threadlinqs.com/threat/TL-2026-1524) — medium — 2026-02-24 - [PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote…](https://intel.threadlinqs.com/threat/TL-2026-0135) — high — 2026-02-23 - [ZeroDayRAT Commercial Mobile Spyware — Telegram-Sold Cross-Platform Android/iOS Surveillance, Live…](https://intel.threadlinqs.com/threat/TL-2026-0116) — high — 2026-02-16 ## Related CVEs CVEs referenced by the tracked threats that use T1512, most frequent first. - [CVE-2021-30860](https://intel.threadlinqs.com/cve/CVE-2021-30860) - [CVE-2016-4655](https://intel.threadlinqs.com/cve/CVE-2016-4655) - [CVE-2016-4656](https://intel.threadlinqs.com/cve/CVE-2016-4656) - [CVE-2016-4657](https://intel.threadlinqs.com/cve/CVE-2016-4657) - [CVE-2023-41061](https://intel.threadlinqs.com/cve/CVE-2023-41061) - [CVE-2023-41064](https://intel.threadlinqs.com/cve/CVE-2023-41064) - [CVE-2024-43047](https://intel.threadlinqs.com/cve/CVE-2024-43047) - [CVE-2024-50302](https://intel.threadlinqs.com/cve/CVE-2024-50302) - [CVE-2024-53104](https://intel.threadlinqs.com/cve/CVE-2024-53104) - [CVE-2024-53197](https://intel.threadlinqs.com/cve/CVE-2024-53197) - [CVE-2025-31200](https://intel.threadlinqs.com/cve/CVE-2025-31200) - [CVE-2025-31201](https://intel.threadlinqs.com/cve/CVE-2025-31201) - [CVE-2025-43200](https://intel.threadlinqs.com/cve/CVE-2025-43200) ## Detection coverage Threadlinqs maintains 23 detection rules mapped to T1512 (SPL 6, KQL 10, Sigma 7). Rule content is available to Blue tier accounts and above; this page shows counts only. 23 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1512 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)