Activity timeline
T1659 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-10 with 6 reports, and 12 of the 12 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1659 Content Injection is catalogued by MITRE ATT&CK under the Initial Access and Command and Control tactics in the Enterprise matrix. Threadlinqs maps 12 of 3252 tracked threats (0.4%) to it; by severity that is 9 high, 3 medium.
Threats that use T1659 most often also use T1027 Obfuscated Files or Information (6 threats), T1059.007 JavaScript (6 threats), T1071.001 Web Protocols (6 threats), T1105 Ingress Tool Transfer (5 threats), T1190 Exploit Public-Facing Application (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
6 tracked threat actors appear in the threats that use T1659; the most frequent are GTG-20006 (1), PARS Defense (1), SHADOW-WATER-063 (1), UNC6353 (1), UNC6691 (1).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1659.
Data sources
Telemetry that can reveal T1659, per MITRE ATT&CK.
- File — File Creation
- Network Traffic — Network Traffic Content
- Process — Process Creation
Threat actors using it
Tracked threats
12 tracked threats use T1659.
- EtherHiding Campaign Evolves: Blockchain-Hosted Payloads on 5,400+ Compromised Sites Add Covert WebRTC Data…high
- Parasite-SEO / TDS campaign abusing 2,167 compromised .gov and .edu domains, exposed via OnlyFans DMCA…medium
- Hotejka Help TDS Abuses 20,000+ Cloudflare Pages Domains to Push Fake Microsoft Security Alerts (Tech…medium
- Coruna and DarkSword iOS Exploit Kits Compromise iPhones via Single Malicious Website (UNC6353, UNC6691…high
- Midnight Blizzard-Linked GTG-20006 Uses Claude Agents to Rebuild and Redeploy Detected Malware (CornFlake Go…high
- Google's PageBreak AI Agent Finds 500+ Verified XSS Flaws and Builds Working Exploit Chainsmedium
- Lunex Stealer Abuses Vulnerable AMD Radeon Driver (CVE-2023-20598) to Blind Security Monitoring and Steal…high
- Adform Ad-Tech Platform Compromised: Trojanized Tracking Script Serves Crypto Clipboard Stealer via…high
- AutoJack: AutoGen Studio MCP WebSocket Exploit Chain Turns an AI Browsing Agent into a Host RCE Vectorhigh
- AI-Generated ClickFix Campaign Delivers SmartRAT/Banana RAT PowerShell Banking Trojan Targeting Brazilian…high
- Laravel Framework CRLF Injection (CVE-2026-48019) — Outbound Email Header/Content Manipulation (CWE-93)high
- WordPress Malware Abuses Steam Community Profiles for C2 — Unicode Steganography, AES-256-CTR Payloads…high
Detection coverage
Threadlinqs maintains 27 detection rules mapped to T1659 (SPL 7, KQL 8, Sigma 12). Rule content is available to Blue tier accounts and above; this page shows counts only.