[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1566-003":3},{"item":4,"lessons":18,"controls":44,"related":72},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1566-003","T1566.003","Spearphishing via Service",6,"MITRE","**What attackers do.** Attackers send spearphishing messages through third-party services such as social media, personal webmail, messaging apps or collaboration platforms, where corporate email filtering does not apply. This Phishing sub-technique serves Initial Access.\n\n**How to defend.** Train staff that lures can arrive through any channel, including job offers and messages on professional networks. Apply security controls to collaboration platforms, restrict external messaging where unneeded, and treat files from personal channels with the same caution as email attachments. Endpoint detection still sees what happens after a file is opened, whatever channel delivered it.\n\n**Signs to look for.** Look for downloads from social or messaging platforms followed by suspicious execution, external contacts initiating chats with staff, and malware arriving outside email. A common gap is having no visibility of personal channels used on corporate devices.","Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. \n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services.\n\nA common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F003\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"dprk-uses-simple-phishing-to-harvest-ukraine-war-intelligence","DPRK Uses Simple Phishing to Harvest Ukraine War Intelligence","2026-10-13T22:21:00.206+00:00",{"slug":25,"title":26,"published_at":27},"fake-job-recruiters-drain-1071m-in-crypto-via-malware-campaign","Fake Job Recruiters Drain $10.71M in Crypto via Malware Campaign","2026-09-21T20:21:06.891+00:00",{"slug":29,"title":30,"published_at":31},"north-korean-hackers-exploit-job-seekers-to-steal-crypto-and-data","North Korean Hackers Exploit Job Seekers to Steal Crypto and Data","2026-09-18T16:20:24.178+00:00",{"slug":33,"title":34,"published_at":35},"synkloader-malware-spread-via-fake-it-help-desk-on-microsoft-teams","SynkLoader Malware Spread via Fake IT Help Desk on Microsoft Teams","2026-08-21T20:20:40.244+00:00",{"slug":37,"title":38,"published_at":39},"fake-crypto-exec-weaponizes-google-doc-to-target-security-researcher-post-def-con","Fake Crypto Exec Weaponizes Google Doc to Target Security Researcher Post-DEF CON","2026-08-19T16:21:26.509+00:00",{"slug":41,"title":42,"published_at":43},"hotel-wi-fi-gateways-weaponized-to-steal-microsoft-365-credentials","Hotel Wi-Fi Gateways Weaponized to Steal Microsoft 365 Credentials","2026-07-27T16:21:48.626+00:00",[45,50,54,58,63,68],{"slug":46,"name":47,"problem":48,"stories":49},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",4,{"slug":51,"name":52,"problem":53,"stories":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":55,"name":56,"problem":57,"stories":49},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":59,"name":60,"problem":61,"stories":62},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",3,{"slug":64,"name":65,"problem":66,"stories":67},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",1,{"slug":69,"name":70,"problem":71,"stories":67},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[73,78,84,89,93,97,101,105],{"family":74,"item":75,"code":76,"title":77,"together":9},"cis","14","Control 14","Security Awareness and Skills Training",{"family":79,"item":80,"code":81,"title":82,"together":83},"gdpr","32","Article 32","Security of processing",5,{"family":85,"item":86,"code":87,"title":88,"together":83},"nist-800-53","at-2","AT-2","Literacy Training and Awareness",{"family":85,"item":90,"code":91,"title":92,"together":49},"si-3","SI-3","Malicious Code Protection",{"family":74,"item":94,"code":95,"title":96,"together":62},"10","Control 10","Malware Defenses",{"family":98,"item":99,"code":100,"title":100,"together":62},"itil","overview","ITIL",{"family":74,"item":102,"code":103,"title":104,"together":62},"9","Control 9","Email and Web Browser Protections",{"family":74,"item":106,"code":107,"title":108,"together":109},"4","Control 4","Secure Configuration of Enterprise Assets and Software",2]