# T1516 Input Injection > As of 2026-10-05, T1516 (Input Injection) appears in 24 tracked threats, first reported 2026-02-23 and most recently 2026-09-28; it most often appears alongside T1660 (Phishing). - **Tracked threats:** 24 (1 critical, 21 high, 2 medium) - **First seen:** 2026-02-23 - **Last seen:** 2026-09-28 - **Detection rules:** 39 (counts only; Blue tier and above) ## Key facts - **ID:** T1516 - **Framework:** MITRE ATT&CK - **Tactics:** Defense Evasion (Mobile), Impact (Mobile) - **Matrix:** Mobile - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1516/ ## Activity timeline T1516 first appeared in tracked threats on 2026-02-23 and was most recently reported on 2026-09-28. The busiest month was 2026-09 with 8 reports, and 24 of the 24 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1516 Input Injection is catalogued by MITRE ATT&CK under the Defense Evasion (Mobile) and Impact (Mobile) tactics in the Mobile matrix. Threadlinqs maps 24 of 2623 tracked threats (0.9%) to it; by severity that is 1 critical, 21 high, 2 medium. Threats that use T1516 most often also use [T1660 Phishing](https://intel.threadlinqs.com/technique/T1660) (22 threats), [T1513 Screen Capture](https://intel.threadlinqs.com/technique/T1513) (19 threats), [T1418 Software Discovery](https://intel.threadlinqs.com/technique/T1418) (18 threats), [T1426 System Information Discovery](https://intel.threadlinqs.com/technique/T1426) (14 threats), [T1437 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1437) (13 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. ## Mitigations MITRE ATT&CK lists 2 mitigations for T1516. - [M1011 User Guidance](https://attack.mitre.org/mitigations/M1011/) - [M1012 Enterprise Policy](https://attack.mitre.org/mitigations/M1012/) ## Tracked threats 24 tracked threats use T1516. - [GitHub Security Lab AI Agent Uncovers 24 Android App Vulnerabilities, Including OsmAnd Location-Tracking…](https://intel.threadlinqs.com/threat/TL-2026-2744) — medium — 2026-09-28 - [RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritization](https://intel.threadlinqs.com/threat/TL-2026-2743) — high — 2026-09-28 - [RemControl Android Banking Trojan Targets Italy and France via Fake TVTap IPTV App](https://intel.threadlinqs.com/threat/TL-2026-2625) — high — 2026-09-23 - [RatHat: AI-Powered Android Banking Trojan Abuses Accessibility Service and ADB to Steal Credentials, PINs…](https://intel.threadlinqs.com/threat/TL-2026-2592) — high — 2026-09-20 - [Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)](https://intel.threadlinqs.com/threat/TL-2026-2444) — high — 2026-09-11 - [Mantax Otax: Indonesian Android Malware Combines Ransomware with Spyware Integration](https://intel.threadlinqs.com/threat/TL-2026-2719) — high — 2026-09-09 - [StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTok](https://intel.threadlinqs.com/threat/TL-2026-2312) — high — 2026-09-03 - [Chinese-Speaking Threat Actors Deploy PanDa Android RAT Against Mexican Banking Users via Meta Ads…](https://intel.threadlinqs.com/threat/TL-2026-2279) — high — 2026-09-01 - [ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countries](https://intel.threadlinqs.com/threat/TL-2026-2128) — high — 2026-08-24 - [WindRelay Android NFC Relay Malware Paired With SpyNote RAT Enables Real-Time Bank Card "Ghost Tapping" Fraud](https://intel.threadlinqs.com/threat/TL-2026-2003) — high — 2026-08-13 - [WindRelay + SpyNote Combo: NFC Relay Malware Enables Contactless Card Fraud Across Central/Eastern Europe](https://intel.threadlinqs.com/threat/TL-2026-1995) — high — 2026-08-12 - [Inside the Underground Business of the BTMOB Android RAT Malware-as-a-Service](https://intel.threadlinqs.com/threat/TL-2026-1841) — high — 2026-08-03 - [Copybara Android RAT Delivered via Fake N26 Support Vishing Calls](https://intel.threadlinqs.com/threat/TL-2026-1804) — high — 2026-08-01 - [Flying Eagle Android RAT: Leaked Source Code Powers 170 Active C2 Servers, Successor "Night Dragon" Emerges](https://intel.threadlinqs.com/threat/TL-2026-1757) — high — 2026-07-29 - [RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutions](https://intel.threadlinqs.com/threat/TL-2026-1478) — high — 2026-07-18 - [Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…](https://intel.threadlinqs.com/threat/TL-2026-1225) — high — 2026-07-11 - [Glitch SPY Android RAT Distributed via Fake Polish Rental App ("Tutaj Dom") Using Brokewell Loader](https://intel.threadlinqs.com/threat/TL-2026-1195) — high — 2026-07-10 - [Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Play](https://intel.threadlinqs.com/threat/TL-2026-1059) — high — 2026-07-02 - [Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commands](https://intel.threadlinqs.com/threat/TL-2026-0826) — high — 2026-06-16 - [Android.MagicAd Trojan Floods Devices with Ads via Xiaomi GetApps, Samsung Galaxy Store, and Preinstalled…](https://intel.threadlinqs.com/threat/TL-2026-0737) — medium — 2026-06-09 - [BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…](https://intel.threadlinqs.com/threat/TL-2026-0600) — high — 2026-05-27 - [OverlayPhantom Android Banking Trojan — Novel Overlay-Driven Credential Theft Targeting 180+ Banking and…](https://intel.threadlinqs.com/threat/TL-2026-0598) — critical — 2026-05-27 - [SURXRAT Android RAT — LLM Module Downloads from Hugging Face, MaaS via Telegram, ArsinkRAT Evolution](https://intel.threadlinqs.com/threat/TL-2026-0142) — high — 2026-02-24 - [PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote…](https://intel.threadlinqs.com/threat/TL-2026-0135) — high — 2026-02-23 ## Detection coverage Threadlinqs maintains 39 detection rules mapped to T1516 (SPL 14, KQL 13, Sigma 12). Rule content is available to Blue tier accounts and above; this page shows counts only. 39 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1516 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)