Activity timeline
T1630 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 4 reports, and 11 of the 11 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1630 Indicator Removal on Host is catalogued by MITRE ATT&CK under the Defense Evasion (Mobile) tactic in the Mobile matrix. Threadlinqs maps 11 of 2623 tracked threats (0.4%) to it; by severity that is 10 high, 1 low.
Threats that use T1630 most often also use T1417 Input Capture (9 threats), T1437 Application Layer Protocol (9 threats), T1636 Protected User Data (9 threats), T1426 System Information Discovery (8 threats), T1429 Audio Capture (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
2 tracked threat actors appear in the threats that use T1630; the most frequent are Intellexa Consortium (2), NSO Group (2).
Mitigations
MITRE ATT&CK lists 3 mitigations for T1630.
Threat actors using it
Tracked threats
11 tracked threats use T1630.
- StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTokhigh
- Apple Expands On-Device Lock Screen Alerts for Mercenary Spyware Targetshigh
- Inside the Underground Business of the BTMOB Android RAT Malware-as-a-Servicehigh
- Flying Eagle Android RAT: Leaked Source Code Powers 170 Active C2 Servers, Successor "Night Dragon" Emergeshigh
- Research: Android ML Malware Detectors Collapse Without Context-Stage Analysis (PRAXIS vs. Drebin, MalScan…low
- RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutionshigh
- Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…high
- Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…high
- NSO Group Pegasus Spyware — WhatsApp Spearphishing Campaign Alleged in Meta Contempt Complaint (June 2026)high
- Predator Spyware: Undocumented iOS Kernel Exploitation Engine (FDGuardNeonRW, PAC Bypass, RWTransfer)high
- Trojanized Red Alert Rocket Warning App — Arid Viper Mobile Spyware Campaign Targeting Israeli Usershigh
Detection coverage
Threadlinqs maintains 15 detection rules mapped to T1630 (SPL 4, KQL 5, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only.
Sub-techniques
- T1630.001 Uninstall Malicious Application — 1 tracked threat
- T1630.002 File Deletion — 3 tracked threats
- T1630.003 Disguise Root/Jailbreak Indicators — 1 tracked threat