[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1534":3},{"item":4,"lessons":18,"controls":40,"related":64},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1534","T1534","Internal Spearphishing",5,"MITRE","**What attackers do.** After gaining access to an internal account, attackers send phishing messages from it to colleagues, who are more likely to trust a message from a known address. This serves the Lateral Movement tactic.\n\n**How to defend.** Apply the same filtering to internal mail and chat as to external mail, protect accounts with phishing-resistant MFA and monitor for compromised mailboxes. Make it easy to report suspicious internal messages and act quickly to contain the sending account. Revoke sessions and reset credentials for the sending account as soon as compromise is confirmed.\n\n**Signs to look for.** Look for internal accounts sending unusual volumes of messages, messages with links or attachments unlike the sender's normal pattern, and new inbox rules hiding replies. A common gap is internal mail bypassing security scanning.","After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation.\n\nFor example, adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic login interfaces.\n\nAdversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and\u002For credentials.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1534\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"fake-ai-chatbot-sites-harvest-mfa-codes-via-browser-in-browser-phishing","Fake AI Chatbot Sites Harvest MFA Codes via Browser-in-Browser Phishing","2026-10-06T16:21:11.157+00:00",{"slug":25,"title":26,"published_at":27},"chinese-threat-group-impersonates-us-officials-to-target-ai-policy-experts","Chinese Threat Group Impersonates US Officials to Target AI Policy Experts","2026-10-05T18:21:07.128+00:00",{"slug":29,"title":30,"published_at":31},"social-engineering-shifts-to-microsoft-teams-as-phishing-platforms-decline","Social Engineering Shifts to Microsoft Teams as Phishing Platforms Decline","2026-07-23T16:20:57.511+00:00",{"slug":33,"title":34,"published_at":35},"scattered-spider-hackers-jailed-for-29m-tfl-breach","Scattered Spider Hackers Jailed for £29M TfL Breach","2026-07-16T20:20:59.605+00:00",{"slug":37,"title":38,"published_at":39},"scattered-spider-member-extradited-100m-hacking-spree-highlights-social-engineering-risks","Scattered Spider Member Extradited: $100M Hacking Spree Highlights Social Engineering Risks","2026-07-03T10:20:41.279+00:00",[41,46,51,55,60],{"slug":42,"name":43,"problem":44,"stories":45},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",3,{"slug":47,"name":48,"problem":49,"stories":50},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",2,{"slug":52,"name":53,"problem":54,"stories":50},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":56,"name":57,"problem":58,"stories":59},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",1,{"slug":61,"name":62,"problem":63,"stories":59},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[65,70,75,80,85,90,94,98],{"family":66,"item":67,"code":68,"title":69,"together":9},"cis","14","Control 14","Security Awareness and Skills Training",{"family":71,"item":72,"code":73,"title":74,"together":9},"gdpr","32","Article 32","Security of processing",{"family":66,"item":76,"code":77,"title":78,"together":79},"6","Control 6","Access Control Management",4,{"family":81,"item":82,"code":83,"title":84,"together":45},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",{"family":86,"item":87,"code":88,"title":89,"together":45},"nist-800-53","ac-2","AC-2","Account Management",{"family":86,"item":91,"code":92,"title":93,"together":45},"at-2","AT-2","Literacy Training and Awareness",{"family":66,"item":95,"code":96,"title":97,"together":50},"9","Control 9","Email and Web Browser Protections",{"family":66,"item":99,"code":100,"title":101,"together":50},"17","Control 17","Incident Response Management"]