[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1566-002":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1566-002","T1566.002","Spearphishing Link",34,"MITRE","**What attackers do.** Attackers send targeted emails containing a link to a malicious download, a fake login page or an OAuth consent prompt, rather than attaching the payload. This Phishing sub-technique serves Initial Access and is commonly used for credential theft.\n\n**How to defend.** Use URL rewriting and time-of-click analysis, block newly registered and low-reputation domains at the proxy, and use phishing-resistant MFA so captured passwords are less useful. Restrict which users can grant consent to third-party applications. Correlate email logs with proxy and identity logs so a click can be linked to any later sign-in.\n\n**Signs to look for.** Look for clicks on lookalike or freshly registered domains, logins from new locations right after a click, and new OAuth application grants. A common gap is following the redirect chain, since attackers often route links through legitimate services first.","Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.\n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place.\n\nAdversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp:\u002F\u002Fgoogle.com@1157586937`.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F002\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"aitm-phishing-campaign-bypasses-mfa-to-steal-google-credentials-from-taiwan-researchers","AitM Phishing Campaign Bypasses MFA to Steal Google Credentials from Taiwan Researchers","2026-10-16T18:21:24.446+00:00",{"slug":25,"title":26,"published_at":27},"fake-ai-ad-portals-steal-credentials-and-mfa-codes-via-browser-in-the-browser-phishing","Fake AI Ad Portals Steal Credentials and MFA Codes via Browser-in-the-Browser Phishing","2026-10-06T22:21:47.539+00:00",{"slug":29,"title":30,"published_at":31},"china-linked-ta419-uses-aitm-phishing-to-target-ai-policy-experts","China-Linked TA419 Uses AitM Phishing to Target AI Policy Experts","2026-10-04T08:20:33.784+00:00",{"slug":33,"title":34,"published_at":35},"china-linked-group-phishes-ai-policy-experts-via-fake-microsoft-login-pages","China-Linked Group Phishes AI Policy Experts via Fake Microsoft Login Pages","2026-10-01T16:22:11.851+00:00",{"slug":37,"title":38,"published_at":39},"compromised-placeholder-domain-delivers-clickfix-social-engineering-attack","Compromised Placeholder Domain Delivers ClickFix Social Engineering Attack","2026-09-24T00:20:25.624+00:00",{"slug":41,"title":42,"published_at":43},"darkme-rat-campaign-swaps-zero-days-for-fake-image-file-lures","DarkMe RAT Campaign Swaps Zero-Days for Fake Image File Lures","2026-09-23T12:21:28.922+00:00",{"slug":45,"title":46,"published_at":47},"zero-day-exploit-chain-targets-ngos-via-spear-phishing-and-compromised-university-site","Zero-Day Exploit Chain Targets NGOs via Spear-Phishing and Compromised University Site","2026-09-15T08:20:56.69+00:00",{"slug":49,"title":50,"published_at":51},"passkey-phishing-campaigns-harvest-microsoft-365-credentials-and-session-tokens","Passkey-Phishing Campaigns Harvest Microsoft 365 Credentials and Session Tokens","2026-09-11T18:20:23.292+00:00",{"slug":53,"title":54,"published_at":55},"attackers-weaponize-trusted-ai-platforms-to-deliver-malware","Attackers Weaponize Trusted AI Platforms to Deliver Malware","2026-09-11T16:21:15.497+00:00",{"slug":57,"title":58,"published_at":59},"fake-browser-windows-and-rogue-rmm-tools-enable-persistent-phishing-attacks","Fake Browser Windows and Rogue RMM Tools Enable Persistent Phishing Attacks","2026-09-09T16:22:43.252+00:00",{"slug":61,"title":62,"published_at":63},"blob-url-phishing-bypasses-scanners-by-rendering-malicious-pages-inside-the-browser","Blob URL Phishing Bypasses Scanners by Rendering Malicious Pages Inside the Browser","2026-09-09T10:20:25.805+00:00",{"slug":65,"title":66,"published_at":67},"multi-hop-google-redirects-used-to-bypass-phishing-defenses","Multi-Hop Google Redirects Used to Bypass Phishing Defenses","2026-09-08T22:20:56.137+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",31,{"slug":75,"name":76,"problem":77,"stories":78},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",22,{"slug":80,"name":81,"problem":82,"stories":83},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",21,{"slug":85,"name":86,"problem":87,"stories":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",16,{"slug":90,"name":91,"problem":92,"stories":93},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",6,{"slug":95,"name":96,"problem":97,"stories":98},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",2,[100,106,112,117,122,127,132,137],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","14","Control 14","Security Awareness and Skills Training",29,{"family":107,"item":108,"code":109,"title":110,"together":111},"nist-800-53","si-3","SI-3","Malicious Code Protection",24,{"family":101,"item":113,"code":114,"title":115,"together":116},"9","Control 9","Email and Web Browser Protections",23,{"family":118,"item":119,"code":120,"title":121,"together":78},"gdpr","32","Article 32","Security of processing",{"family":107,"item":123,"code":124,"title":125,"together":126},"at-2","AT-2","Literacy Training and Awareness",19,{"family":101,"item":128,"code":129,"title":130,"together":131},"6","Control 6","Access Control Management",13,{"family":107,"item":133,"code":134,"title":135,"together":136},"ac-17","AC-17","Remote Access",12,{"family":138,"item":139,"code":140,"title":141,"together":142},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",11]