# T1658 Exploitation for Client Execution > As of 2026-10-10, T1658 (Exploitation for Client Execution) appears in 10 tracked threats, first reported 2026-04-22 and most recently 2026-10-09, with linked actors including NSO Group; it most often appears alongside T1426 (System Information Discovery). - **Tracked threats:** 10 (1 critical, 7 high, 1 medium) - **First seen:** 2026-04-22 - **Last seen:** 2026-10-09 - **Threat actors:** 1 - **Detection rules:** 27 (counts only; Blue tier and above) ## Key facts - **ID:** T1658 - **Framework:** MITRE ATT&CK - **Tactics:** Execution (Mobile) - **Matrix:** Mobile - **Data as of:** 2026-10-10 - **MITRE:** https://attack.mitre.org/techniques/T1658/ ## Activity timeline T1658 first appeared in tracked threats on 2026-04-22 and was most recently reported on 2026-10-09. The busiest month was 2026-09 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1658 Exploitation for Client Execution is catalogued by MITRE ATT&CK under the Execution (Mobile) tactic in the Mobile matrix. Threadlinqs maps 10 of 2756 tracked threats (0.4%) to it; by severity that is 1 critical, 7 high, 1 medium. Threats that use T1658 most often also use [T1426 System Information Discovery](https://intel.threadlinqs.com/technique/T1426) (7 threats), [T1664 Exploitation for Initial Access](https://intel.threadlinqs.com/technique/T1664) (7 threats), [T1404 Exploitation for Privilege Escalation](https://intel.threadlinqs.com/technique/T1404) (6 threats), [T1409 Stored Application Data](https://intel.threadlinqs.com/technique/T1409) (6 threats), [T1429 Audio Capture](https://intel.threadlinqs.com/technique/T1429) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 1 tracked threat actor appear in the threats that use T1658; the most frequent are [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) (3). ## Mitigations MITRE ATT&CK lists 2 mitigations for T1658. - [M1001 Security Updates](https://attack.mitre.org/mitigations/M1001/) - [M1011 User Guidance](https://attack.mitre.org/mitigations/M1011/) ## Threat actors using it - [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) — 3 ## Tracked threats 10 tracked threats use T1658. - [Pwn2Own Ireland 2026: Google Pixel 10 Exploit Chains Earn $560,000](https://intel.threadlinqs.com/threat/TL-2026-3103) — medium — 2026-10-09 - [Apple CoreGraphics Out-of-Bounds Write (CVE-2026-86950) Possibly Exploited in Targeted Attacks](https://intel.threadlinqs.com/threat/TL-2026-2745) — high — 2026-09-28 - [Zero-click Pixel 10 exploit chain: VPU driver mmap flaw (CVE-2026-0106) enables arbitrary kernel read/write…](https://intel.threadlinqs.com/threat/TL-2026-2418) — critical — 2026-09-09 - [Pegasus Spyware Used to Hack Phone of Former MEP Stelios Kouloglou, PEGA Committee Member](https://intel.threadlinqs.com/threat/TL-2026-2324) — high — 2026-09-04 - [Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…](https://intel.threadlinqs.com/threat/TL-2026-2316) — high — 2026-09-03 - [Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to Full Android Kernel Access](https://intel.threadlinqs.com/threat/TL-2026-2049) — high — 2026-08-17 - [NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions…](https://intel.threadlinqs.com/threat/TL-2026-1748) — 2026-07-28 - [Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…](https://intel.threadlinqs.com/threat/TL-2026-0751) — high — 2026-06-10 - [NSO Group Pegasus Spyware — WhatsApp Spearphishing Campaign Alleged in Meta Contempt Complaint (June 2026)](https://intel.threadlinqs.com/threat/TL-2026-0728) — high — 2026-06-09 - [NGate Android NFC Relay Malware Variant - Trojanized HandyPay Banking App Campaign Targeting Brazil…](https://intel.threadlinqs.com/threat/TL-2026-0407) — high — 2026-04-22 ## Related CVEs CVEs referenced by the tracked threats that use T1658, most frequent first. - [CVE-2021-30860](https://intel.threadlinqs.com/cve/CVE-2021-30860) - [CVE-2016-4655](https://intel.threadlinqs.com/cve/CVE-2016-4655) - [CVE-2016-4656](https://intel.threadlinqs.com/cve/CVE-2016-4656) - [CVE-2016-4657](https://intel.threadlinqs.com/cve/CVE-2016-4657) - [CVE-2023-41061](https://intel.threadlinqs.com/cve/CVE-2023-41061) - [CVE-2023-41064](https://intel.threadlinqs.com/cve/CVE-2023-41064) - [CVE-2019-3568](https://intel.threadlinqs.com/cve/CVE-2019-3568) - [CVE-2024-43047](https://intel.threadlinqs.com/cve/CVE-2024-43047) - [CVE-2024-50302](https://intel.threadlinqs.com/cve/CVE-2024-50302) - [CVE-2024-53104](https://intel.threadlinqs.com/cve/CVE-2024-53104) - [CVE-2024-53197](https://intel.threadlinqs.com/cve/CVE-2024-53197) - [CVE-2025-31200](https://intel.threadlinqs.com/cve/CVE-2025-31200) - [CVE-2025-31201](https://intel.threadlinqs.com/cve/CVE-2025-31201) - [CVE-2025-36934](https://intel.threadlinqs.com/cve/CVE-2025-36934) - [CVE-2025-54957](https://intel.threadlinqs.com/cve/CVE-2025-54957) - [CVE-2026-0106](https://intel.threadlinqs.com/cve/CVE-2026-0106) - [CVE-2026-86950](https://intel.threadlinqs.com/cve/CVE-2026-86950) ## Detection coverage Threadlinqs maintains 27 detection rules mapped to T1658 (SPL 9, KQL 9, Sigma 9). Rule content is available to Blue tier accounts and above; this page shows counts only. 27 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1658 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)