[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1566":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1566","T1566","Phishing",160,"MITRE","**What attackers do.** Attackers send deceptive emails, messages or links that trick people into opening a malicious file, visiting a fake site or handing over credentials. It is one of the most common ways into an organisation and serves the Initial Access tactic.\n\n**How to defend.** Layer email security: filter attachments and links, enforce SPF, DKIM and DMARC, and sandbox or rewrite URLs at click time. Use phishing-resistant MFA so stolen passwords alone are not enough, and make it easy for staff to report suspicious messages with one click. Feed email gateway, proxy and endpoint telemetry into one place so a reported message can be traced to every recipient quickly.\n\n**Signs to look for.** Look for lookalike sender domains, newly registered domains in links, unexpected attachments such as archives, ISO or HTML files, and Office processes spawning scripts or shells. A common gap is not correlating a user's report with who else received and clicked the same message.","Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.\n\nAdversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services (like social media platforms) or delivered via calendar invites. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata\u002Fheaders from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\").\n\nVictims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"fake-ai-brand-impersonation-campaigns-target-enterprise-developers","Fake AI Brand Impersonation Campaigns Target Enterprise Developers","2026-10-16T22:20:50.472+00:00",{"slug":25,"title":26,"published_at":27},"fake-ai-tools-used-to-distribute-malware-and-steal-business-credentials","Fake AI Tools Used to Distribute Malware and Steal Business Credentials","2026-10-15T14:21:08.398+00:00",{"slug":29,"title":30,"published_at":31},"billion-message-phishing-infrastructure-dismantled-by-microsoft-and-partners","Billion-Message Phishing Infrastructure Dismantled by Microsoft and Partners","2026-10-15T12:20:54.937+00:00",{"slug":33,"title":34,"published_at":35},"phishing-as-a-service-how-yam-store-weaponized-cloud-infrastructure-at-scale","Phishing-as-a-Service: How Yam Store Weaponized Cloud Infrastructure at Scale","2026-10-14T22:20:50.865+00:00",{"slug":37,"title":38,"published_at":39},"chinese-language-phishing-as-a-service-market-disrupted-after-1b-malicious-messages","Chinese-Language Phishing-as-a-Service Market Disrupted After 1B+ Malicious Messages","2026-10-14T14:21:21.247+00:00",{"slug":41,"title":42,"published_at":43},"billion-message-phishing-ecosystem-targeting-microsoft-users-dismantled","Billion-Message Phishing Ecosystem Targeting Microsoft Users Dismantled","2026-10-14T14:20:50.56+00:00",{"slug":45,"title":46,"published_at":47},"legitimate-tools-weaponized-teams-phishing-npm-worms-and-device-code-abuse","Legitimate Tools Weaponized: Teams Phishing, npm Worms, and Device-Code Abuse","2026-10-13T16:20:16.436+00:00",{"slug":49,"title":50,"published_at":51},"ai-accelerated-attacks-outpace-traditional-defenses","AI-Accelerated Attacks Outpace Traditional Defenses","2026-10-13T12:21:32.737+00:00",{"slug":53,"title":54,"published_at":55},"avisloader-uses-p2p-c2-and-social-engineering-to-evade-takedowns","AvisLoader Uses P2P C2 and Social Engineering to Evade Takedowns","2026-10-12T16:20:38.324+00:00",{"slug":57,"title":58,"published_at":59},"russian-apt-uac-0099-upgrades-matchboil-malware-with-enhanced-stealth-against-ukrainian-targets","Russian APT UAC-0099 Upgrades MatchBoil Malware with Enhanced Stealth Against Ukrainian Targets","2026-10-08T20:21:35.327+00:00",{"slug":61,"title":62,"published_at":63},"ashvein-rat-targets-ukrainian-officials-via-html-concealed-commands-and-institutional-impersonation","ASHVEIN RAT Targets Ukrainian Officials via HTML-Concealed Commands and Institutional Impersonation","2026-10-08T17:20:25.103+00:00",{"slug":65,"title":66,"published_at":67},"wazza-phishing-kit-bypasses-detection-to-harvest-credentials-across-critical-sectors","Wazza Phishing Kit Bypasses Detection to Harvest Credentials Across Critical Sectors","2026-10-08T12:20:37.933+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",116,{"slug":75,"name":76,"problem":77,"stories":78},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",97,{"slug":80,"name":81,"problem":82,"stories":83},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",67,{"slug":85,"name":86,"problem":87,"stories":88},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",58,{"slug":90,"name":91,"problem":92,"stories":93},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",38,{"slug":95,"name":96,"problem":97,"stories":98},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",15,[100,106,112,118,123,128,134,139],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","14","Control 14","Security Awareness and Skills Training",120,{"family":107,"item":108,"code":109,"title":110,"together":111},"gdpr","32","Article 32","Security of processing",99,{"family":113,"item":114,"code":115,"title":116,"together":117},"nist-800-53","si-3","SI-3","Malicious Code Protection",91,{"family":101,"item":119,"code":120,"title":121,"together":122},"9","Control 9","Email and Web Browser Protections",81,{"family":113,"item":124,"code":125,"title":126,"together":127},"at-2","AT-2","Literacy Training and Awareness",71,{"family":129,"item":130,"code":131,"title":132,"together":133},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",54,{"family":101,"item":135,"code":136,"title":137,"together":138},"6","Control 6","Access Control Management",53,{"family":113,"item":140,"code":141,"title":142,"together":143},"ac-17","AC-17","Remote Access",52]