# T1636 Protected User Data

> As of 2026-10-05, T1636 (Protected User Data) appears in 27 tracked threats, first reported 2026-02-23 and most recently 2026-10-04, with linked actors including NSO Group, APT37, Cyber Av3ngers; it most often appears alongside T1417 (Input Capture).

- **Tracked threats:** 27 (3 critical, 21 high, 2 medium, 1 low)
- **First seen:** 2026-02-23
- **Last seen:** 2026-10-04
- **Threat actors:** 5
- **Detection rules:** 14 (counts only; Blue tier and above)

## Key facts

- **ID:** T1636
- **Framework:** MITRE ATT&CK
- **Tactics:** Collection (Mobile)
- **Matrix:** Mobile
- **Data as of:** 2026-10-05
- **MITRE:** https://attack.mitre.org/techniques/T1636/

## Activity timeline

T1636 first appeared in tracked threats on 2026-02-23 and was most recently reported on 2026-10-04. The busiest month was 2026-07 with 12 reports, and 27 of the 27 threats were reported in the twelve months to 2026-10.

## How adversaries use it

T1636 Protected User Data is catalogued by MITRE ATT&CK under the Collection (Mobile) tactic in the Mobile matrix. Threadlinqs maps 27 of 2623 tracked threats (1%) to it; by severity that is 3 critical, 21 high, 2 medium, 1 low.

Threats that use T1636 most often also use [T1417 Input Capture](https://intel.threadlinqs.com/technique/T1417) (18 threats), [T1437 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1437) (18 threats), [T1646 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1646) (18 threats), [T1426 System Information Discovery](https://intel.threadlinqs.com/technique/T1426) (17 threats), [T1660 Phishing](https://intel.threadlinqs.com/technique/T1660) (17 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

5 tracked threat actors appear in the threats that use T1636; the most frequent are [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) (2), [APT37](https://intel.threadlinqs.com/actor/APT37) (1), [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) (1), [GreyVibe](https://intel.threadlinqs.com/actor/GreyVibe) (1), [Intellexa Consortium](https://intel.threadlinqs.com/actor/Intellexa%20Consortium) (1).

## Mitigations

MITRE ATT&CK lists 2 mitigations for T1636.

- [M1006 Use Recent OS Version](https://attack.mitre.org/mitigations/M1006/)
- [M1011 User Guidance](https://attack.mitre.org/mitigations/M1011/)

## Threat actors using it

- [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) — 2
- [APT37](https://intel.threadlinqs.com/actor/APT37) — 1
- [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) — 1
- [GreyVibe](https://intel.threadlinqs.com/actor/GreyVibe) — 1
- [Intellexa Consortium](https://intel.threadlinqs.com/actor/Intellexa%20Consortium) — 1

## Tracked threats

27 tracked threats use T1636.

- [Critical Capacitor WebView Navigation Guard Bypass Lets Malicious Links Access App Data and Native Features…](https://intel.threadlinqs.com/threat/TL-2026-2894) — critical — 2026-10-04
- [Apple Expands On-Device Lock Screen Alerts for Mercenary Spyware Targets](https://intel.threadlinqs.com/threat/TL-2026-2016) — high — 2026-08-14
- [Inside the Underground Business of the BTMOB Android RAT Malware-as-a-Service](https://intel.threadlinqs.com/threat/TL-2026-1841) — high — 2026-08-03
- [Octagon / OctagonPanel "Ward" Android RAT Impersonates Bahrain's "BH Alert" Civil Defense App to Steal…](https://intel.threadlinqs.com/threat/TL-2026-1832) — high — 2026-08-03
- [Tax Season Phishing and Malware Campaign Targets Indian Taxpayers via Fake Income Tax Department Notices](https://intel.threadlinqs.com/threat/TL-2026-1769) — high — 2026-07-30
- [Flying Eagle Android RAT: Leaked Source Code Powers 170 Active C2 Servers, Successor "Night Dragon" Emerges](https://intel.threadlinqs.com/threat/TL-2026-1757) — high — 2026-07-29
- [Research: Android ML Malware Detectors Collapse Without Context-Stage Analysis (PRAXIS vs. Drebin, MalScan…](https://intel.threadlinqs.com/threat/TL-2026-1753) — low — 2026-07-29
- [UK Supreme Court Rejects Bahrain's State Immunity Claim in FinSpy/FinFisher Spyware Surveillance Case…](https://intel.threadlinqs.com/threat/TL-2026-1726) — medium — 2026-07-27
- [ThreatsDay Bulletin: Iran-Linked CyberAv3ngers PLC Intrusion Campaign (AA26-097A) and OctagonPanel/Ward RAT…](https://intel.threadlinqs.com/threat/TL-2026-1659) — high — 2026-07-23
- [RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutions](https://intel.threadlinqs.com/threat/TL-2026-1478) — high — 2026-07-18
- [Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…](https://intel.threadlinqs.com/threat/TL-2026-1225) — high — 2026-07-11
- [Glitch SPY Android RAT Distributed via Fake Polish Rental App ("Tutaj Dom") Using Brokewell Loader](https://intel.threadlinqs.com/threat/TL-2026-1195) — high — 2026-07-10
- [Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committee](https://intel.threadlinqs.com/threat/TL-2026-1110) — critical — 2026-07-05
- [European Parliament Member Investigating Pegasus Spyware Hacked With Pegasus (PWNYOURHOME Zero-Click Exploit…](https://intel.threadlinqs.com/threat/TL-2026-1099) — critical — 2026-07-03
- [Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…](https://intel.threadlinqs.com/threat/TL-2026-1098) — high — 2026-07-03
- [Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Play](https://intel.threadlinqs.com/threat/TL-2026-1059) — high — 2026-07-02
- [Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commands](https://intel.threadlinqs.com/threat/TL-2026-0826) — high — 2026-06-16
- [Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…](https://intel.threadlinqs.com/threat/TL-2026-0751) — high — 2026-06-10
- [NSO Group Pegasus Spyware — WhatsApp Spearphishing Campaign Alleged in Meta Contempt Complaint (June 2026)](https://intel.threadlinqs.com/threat/TL-2026-0728) — high — 2026-06-09
- [FlagLeft — Microsoft 365 Android Apps Silent Account Takeover via Leftover setIsDebugMode(true) FOCI Token…](https://intel.threadlinqs.com/threat/TL-2026-0671) — high — 2026-06-03
- [GreyVibe — Russian-Aligned AI-Assisted Espionage vs Ukraine: LegionRelay/PhantomRelay PowerShell RATs &…](https://intel.threadlinqs.com/threat/TL-2026-0622) — high — 2026-05-28
- [BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…](https://intel.threadlinqs.com/threat/TL-2026-0600) — high — 2026-05-27
- [TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL for Covert C2 Targeting Banking and Crypto Users…](https://intel.threadlinqs.com/threat/TL-2026-0494) — high — 2026-05-11
- [ScarCruft (APT37) BirdCall Android Variant — Multiplatform Supply-Chain Attack via sqgame\[.\]com\[.\]cn…](https://intel.threadlinqs.com/threat/TL-2026-0460) — high — 2026-05-05
- [Trojanized Red Alert Rocket Warning App — Arid Viper Mobile Spyware Campaign Targeting Israeli Users](https://intel.threadlinqs.com/threat/TL-2026-0192) — high — 2026-03-07
- [Large-Scale Scam and Impersonation Campaign Targeting Commercial Airline Industry (11,600+ Malicious…](https://intel.threadlinqs.com/threat/TL-2026-1524) — medium — 2026-02-24
- [PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote…](https://intel.threadlinqs.com/threat/TL-2026-0135) — high — 2026-02-23

## Related CVEs

CVEs referenced by the tracked threats that use T1636, most frequent first.

- [CVE-2021-30860](https://intel.threadlinqs.com/cve/CVE-2021-30860)
- [CVE-2023-41061](https://intel.threadlinqs.com/cve/CVE-2023-41061)
- [CVE-2023-41064](https://intel.threadlinqs.com/cve/CVE-2023-41064)
- [CVE-2016-4655](https://intel.threadlinqs.com/cve/CVE-2016-4655)
- [CVE-2016-4656](https://intel.threadlinqs.com/cve/CVE-2016-4656)
- [CVE-2016-4657](https://intel.threadlinqs.com/cve/CVE-2016-4657)
- [CVE-2019-3568](https://intel.threadlinqs.com/cve/CVE-2019-3568)
- [CVE-2025-43200](https://intel.threadlinqs.com/cve/CVE-2025-43200)
- [CVE-2026-103922](https://intel.threadlinqs.com/cve/CVE-2026-103922)

## Detection coverage

Threadlinqs maintains 14 detection rules mapped to T1636 (SPL 5, KQL 5, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only.

14 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing

## Sub-techniques

- T1636.001 Calendar Entries — 2 tracked threats
- T1636.002 Call Log — 9 tracked threats
- [T1636.003 Contact List](https://intel.threadlinqs.com/technique/T1636.003) — 17 tracked threats
- [T1636.004 SMS Messages](https://intel.threadlinqs.com/technique/T1636.004) — 20 tracked threats
- T1636.005 Accounts — 0 tracked threats

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1636
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)