[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1566-001":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1566-001","T1566.001","Spearphishing Attachment",37,"MITRE","**What attackers do.** Attackers email a targeted recipient a malicious attachment, such as an Office document with macros, a PDF, an archive or a disk image, hoping they will open it and run the payload. This sub-technique of Phishing serves Initial Access.\n\n**How to defend.** Block or quarantine risky file types at the email gateway and detonate attachments in a sandbox before delivery. Disable macros from internet-sourced files and keep Mark of the Web protections working, including for files inside archives. Endpoint rules that stop Office and PDF readers from launching child processes add a strong second layer.\n\n**Signs to look for.** Look for Office or reader applications spawning script interpreters, files executed from email or download temp folders, and attachments using double extensions or container formats such as ISO and password-protected archives. Gaps often come from archive or image formats that strip protective file markings.","Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.\n\nThere are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F001\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"microsoft-patches-24-rce-flaws-in-office-suite","Microsoft Patches 24 RCE Flaws in Office Suite","2026-10-16T08:20:15.913+00:00",{"slug":25,"title":26,"published_at":27},"cikabika-rat-abuses-discord-and-ngrok-to-evade-detection","CikaBika RAT Abuses Discord and Ngrok to Evade Detection","2026-10-15T12:20:40.147+00:00",{"slug":29,"title":30,"published_at":31},"star-blizzards-redflick-technique-abuses-virtual-disks-and-lnk-files-to-deploy-backdoor","Star Blizzard's RedFlick Technique Abuses Virtual Disks and LNK Files to Deploy Backdoor","2026-09-30T22:20:43.565+00:00",{"slug":33,"title":34,"published_at":35},"global-group-abuses-legitimate-winmerge-tool-to-deploy-ransomware-via-phishing","Global Group Abuses Legitimate WinMerge Tool to Deploy Ransomware via Phishing","2026-09-30T16:20:57.597+00:00",{"slug":37,"title":38,"published_at":39},"russian-apt-star-blizzard-deploys-redflick-malware-via-spear-phishing","Russian APT Star Blizzard Deploys RedFlick Malware via Spear-Phishing","2026-09-30T12:21:47.221+00:00",{"slug":41,"title":42,"published_at":43},"star-blizzard-uses-fake-event-invites-to-deploy-backdoor-across-100-orgs","Star Blizzard Uses Fake Event Invites to Deploy Backdoor Across 100+ Orgs","2026-09-29T20:21:54.152+00:00",{"slug":45,"title":46,"published_at":47},"sidecopy-apt-targets-indian-academia-with-spear-phishing-and-reverserat","SideCopy APT Targets Indian Academia with Spear-Phishing and ReverseRAT","2026-09-22T10:21:48.603+00:00",{"slug":49,"title":50,"published_at":51},"invisible-unicode-characters-used-to-bypass-email-security-filters","Invisible Unicode Characters Used to Bypass Email Security Filters","2026-09-06T16:20:22.447+00:00",{"slug":53,"title":54,"published_at":55},"invisible-unicode-characters-used-to-bypass-email-filters-in-mass-phishing-campaign","Invisible Unicode Characters Used to Bypass Email Filters in Mass Phishing Campaign","2026-09-04T18:22:22.624+00:00",{"slug":57,"title":58,"published_at":59},"invisible-unicode-characters-enable-phishing-filter-evasion-via-ascii-smuggling","Invisible Unicode Characters Enable Phishing Filter Evasion via ASCII Smuggling","2026-09-03T18:20:23.658+00:00",{"slug":61,"title":62,"published_at":63},"phishing-campaign-weaponizes-legitimate-it-tool-to-infiltrate-corporate-networks","Phishing Campaign Weaponizes Legitimate IT Tool to Infiltrate Corporate Networks","2026-09-02T18:22:12.864+00:00",{"slug":65,"title":66,"published_at":67},"phishing-campaign-targets-80000-freelancers-with-malicious-excel-attachments","Phishing Campaign Targets 80,000 Freelancers with Malicious Excel Attachments","2026-09-02T10:21:24.868+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",36,{"slug":75,"name":76,"problem":77,"stories":78},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",32,{"slug":80,"name":81,"problem":82,"stories":83},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",16,{"slug":85,"name":86,"problem":87,"stories":88},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",8,{"slug":90,"name":91,"problem":92,"stories":93},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",4,{"slug":95,"name":96,"problem":97,"stories":98},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",3,[100,106,112,117,122,128,132,137],{"family":101,"item":102,"code":103,"title":104,"together":105},"nist-800-53","si-3","SI-3","Malicious Code Protection",30,{"family":107,"item":108,"code":109,"title":110,"together":111},"cis","9","Control 9","Email and Web Browser Protections",28,{"family":107,"item":113,"code":114,"title":115,"together":116},"14","Control 14","Security Awareness and Skills Training",25,{"family":101,"item":118,"code":119,"title":120,"together":121},"at-2","AT-2","Literacy Training and Awareness",22,{"family":123,"item":124,"code":125,"title":126,"together":127},"gdpr","32","Article 32","Security of processing",19,{"family":107,"item":129,"code":130,"title":131,"together":83},"13","Control 13","Network Monitoring and Defense",{"family":101,"item":133,"code":134,"title":135,"together":136},"sc-7","SC-7","Boundary Protection",15,{"family":107,"item":138,"code":139,"title":140,"together":141},"2","Control 2","Inventory and Control of Software Assets",13]