T1516 Input Injection

Activity timeline

T1516 first appeared in tracked threats on 2026-02-23 and was most recently reported on 2026-09-28. The busiest month was 2026-09 with 8 reports, and 24 of the 24 threats were reported in the twelve months to 2026-09.

How adversaries use it

T1516 Input Injection is catalogued by MITRE ATT&CK under the Defense Evasion (Mobile) and Impact (Mobile) tactics in the Mobile matrix. Threadlinqs maps 24 of 2623 tracked threats (0.9%) to it; by severity that is 1 critical, 21 high, 2 medium.

Threats that use T1516 most often also use T1660 Phishing (22 threats), T1513 Screen Capture (19 threats), T1418 Software Discovery (18 threats), T1426 System Information Discovery (14 threats), T1437 Application Layer Protocol (13 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

Mitigations

MITRE ATT&CK lists 2 mitigations for T1516.

• M1011 User Guidance
• M1012 Enterprise Policy

Tracked threats

24 tracked threats use T1516.

• GitHub Security Lab AI Agent Uncovers 24 Android App Vulnerabilities, Including OsmAnd Location-Tracking…medium2026-09-28
• RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritizationhigh2026-09-28
• RemControl Android Banking Trojan Targets Italy and France via Fake TVTap IPTV Apphigh2026-09-23
• RatHat: AI-Powered Android Banking Trojan Abuses Accessibility Service and ADB to Steal Credentials, PINs…high2026-09-20
• Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)high2026-09-11
• Mantax Otax: Indonesian Android Malware Combines Ransomware with Spyware Integrationhigh2026-09-09
• StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTokhigh2026-09-03
• Chinese-Speaking Threat Actors Deploy PanDa Android RAT Against Mexican Banking Users via Meta Ads…high2026-09-01
• ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countrieshigh2026-08-24
• WindRelay Android NFC Relay Malware Paired With SpyNote RAT Enables Real-Time Bank Card "Ghost Tapping" Fraudhigh2026-08-13
• WindRelay + SpyNote Combo: NFC Relay Malware Enables Contactless Card Fraud Across Central/Eastern Europehigh2026-08-12
• Inside the Underground Business of the BTMOB Android RAT Malware-as-a-Servicehigh2026-08-03
• Copybara Android RAT Delivered via Fake N26 Support Vishing Callshigh2026-08-01
• Flying Eagle Android RAT: Leaked Source Code Powers 170 Active C2 Servers, Successor "Night Dragon" Emergeshigh2026-07-29
• RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutionshigh2026-07-18
• Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…high2026-07-11
• Glitch SPY Android RAT Distributed via Fake Polish Rental App ("Tutaj Dom") Using Brokewell Loaderhigh2026-07-10
• Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Playhigh2026-07-02
• Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commandshigh2026-06-16
• Android.MagicAd Trojan Floods Devices with Ads via Xiaomi GetApps, Samsung Galaxy Store, and Preinstalled…medium2026-06-09
• BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…high2026-05-27
• OverlayPhantom Android Banking Trojan — Novel Overlay-Driven Credential Theft Targeting 180+ Banking and…critical2026-05-27
• SURXRAT Android RAT — LLM Module Downloads from Hugging Face, MaaS via Telegram, ArsinkRAT Evolutionhigh2026-02-24
• PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote…high2026-02-23

Detection coverage

Threadlinqs maintains 39 detection rules mapped to T1516 (SPL 14, KQL 13, Sigma 12). Rule content is available to Blue tier accounts and above; this page shows counts only.