THREATNOIR
Subscribe
MITRE ATT&CK · T1598

Phishing for Information

MITRE · cited in 9 of our lessons

Explanation

What attackers do. Attackers send phishing messages designed to collect information, such as credentials, contact details or internal processes, rather than to deliver malware. This supports the Reconnaissance tactic and prepares later attacks.

How to defend. Train staff to recognise requests for information and to verify unusual requests through a separate channel. Use email filtering, domain impersonation protection and phishing-resistant MFA. Encourage reporting, since information-gathering messages are often the first sign of a targeted campaign. Limit what staff and organisational details are published online, since attackers use them to make requests convincing.

Signs to look for. Look for messages asking for credentials, contact lists or process details, lookalike domains, and replies from staff to external addresses they have never contacted before. A common gap is that these messages contain no malware and pass technical filters.

Open the technique on MITRE ATT&CK
The official text
Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.