Activity timeline
T1658 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-09 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1658 Exploitation for Client Execution is catalogued by MITRE ATT&CK under the Execution (Mobile) tactic in the Mobile matrix. Threadlinqs maps 10 of 2756 tracked threats (0.4%) to it; by severity that is 1 critical, 7 high, 1 medium.
Threats that use T1658 most often also use T1426 System Information Discovery (7 threats), T1664 Exploitation for Initial Access (7 threats), T1404 Exploitation for Privilege Escalation (6 threats), T1409 Stored Application Data (6 threats), T1429 Audio Capture (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
1 tracked threat actor appear in the threats that use T1658; the most frequent are NSO Group (3).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1658.
Threat actors using it
Tracked threats
10 tracked threats use T1658.
- Pwn2Own Ireland 2026: Google Pixel 10 Exploit Chains Earn $560,000medium
- Apple CoreGraphics Out-of-Bounds Write (CVE-2026-86950) Possibly Exploited in Targeted Attackshigh
- Zero-click Pixel 10 exploit chain: VPU driver mmap flaw (CVE-2026-0106) enables arbitrary kernel read/write…critical
- Pegasus Spyware Used to Hack Phone of Former MEP Stelios Kouloglou, PEGA Committee Memberhigh
- Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…high
- Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to Full Android Kernel Accesshigh
- NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions…
- Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…high
- NSO Group Pegasus Spyware — WhatsApp Spearphishing Campaign Alleged in Meta Contempt Complaint (June 2026)high
- NGate Android NFC Relay Malware Variant - Trojanized HandyPay Banking App Campaign Targeting Brazil…high
Detection coverage
Threadlinqs maintains 27 detection rules mapped to T1658 (SPL 9, KQL 9, Sigma 9). Rule content is available to Blue tier accounts and above; this page shows counts only.