[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1598":3},{"item":4,"lessons":18,"controls":56,"related":85},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1598","T1598","Phishing for Information",9,"MITRE","**What attackers do.** Attackers send phishing messages designed to collect information, such as credentials, contact details or internal processes, rather than to deliver malware. This supports the Reconnaissance tactic and prepares later attacks.\n\n**How to defend.** Train staff to recognise requests for information and to verify unusual requests through a separate channel. Use email filtering, domain impersonation protection and phishing-resistant MFA. Encourage reporting, since information-gathering messages are often the first sign of a targeted campaign. Limit what staff and organisational details are published online, since attackers use them to make requests convincing.\n\n**Signs to look for.** Look for messages asking for credentials, contact lists or process details, lookalike domains, and replies from staff to external addresses they have never contacted before. A common gap is that these messages contain no malware and pass technical filters.","Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code.\n\nAll forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns.\n\nAdversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1598\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52],{"slug":21,"title":22,"published_at":23},"billion-message-phishing-infrastructure-dismantled-by-microsoft-and-partners","Billion-Message Phishing Infrastructure Dismantled by Microsoft and Partners","2026-10-15T12:20:54.937+00:00",{"slug":25,"title":26,"published_at":27},"kriminal-ai-platform-lowers-barrier-to-entry-for-cybercrime","Kriminal AI Platform Lowers Barrier to Entry for Cybercrime","2026-08-19T22:21:06.396+00:00",{"slug":29,"title":30,"published_at":31},"vishing-group-unc6671-exploits-employee-trust-to-steal-credentials-and-mfa-tokens","Vishing Group UNC6671 Exploits Employee Trust to Steal Credentials and MFA Tokens","2026-08-07T12:20:19.981+00:00",{"slug":33,"title":34,"published_at":35},"shinyhunters-phishing-infrastructure-100-malicious-domains-uncovered","ShinyHunters Phishing Infrastructure: 100+ Malicious Domains Uncovered","2026-07-31T10:20:57.854+00:00",{"slug":37,"title":38,"published_at":39},"social-engineering-shifts-to-microsoft-teams-as-phishing-platforms-decline","Social Engineering Shifts to Microsoft Teams as Phishing Platforms Decline","2026-07-23T16:20:57.511+00:00",{"slug":41,"title":42,"published_at":43},"scattered-spider-members-jailed-for-tfl-cyberattack-causing-major-disruption","Scattered Spider Members Jailed for TfL Cyberattack Causing Major Disruption","2026-07-17T16:21:01.802+00:00",{"slug":45,"title":46,"published_at":47},"vishing-campaign-hijacks-entra-passkey-enrollment-to-compromise-m365-accounts","Vishing Campaign Hijacks Entra Passkey Enrollment to Compromise M365 Accounts","2026-07-08T18:21:07.366+00:00",{"slug":49,"title":50,"published_at":51},"scattered-spider-teen-extradited-social-engineering-gang-hits-100-firms-for-100m","Scattered Spider Teen Extradited: Social Engineering Gang Hits 100+ Firms for $100M","2026-07-01T20:20:36.875+00:00",{"slug":53,"title":54,"published_at":55},"russian-hackers-target-signal-backup-keys-via-social-engineering","Russian Hackers Target Signal Backup Keys via Social Engineering","2026-06-26T20:20:43.516+00:00",[57,62,67,71,76,81],{"slug":58,"name":59,"problem":60,"stories":61},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",6,{"slug":63,"name":64,"problem":65,"stories":66},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",5,{"slug":68,"name":69,"problem":70,"stories":66},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":72,"name":73,"problem":74,"stories":75},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",3,{"slug":77,"name":78,"problem":79,"stories":80},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":82,"name":83,"problem":84,"stories":80},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[86,91,97,101,106,111,115,119],{"family":87,"item":88,"code":89,"title":90,"together":9},"cis","14","Control 14","Security Awareness and Skills Training",{"family":92,"item":93,"code":94,"title":95,"together":96},"gdpr","32","Article 32","Security of processing",8,{"family":87,"item":98,"code":99,"title":100,"together":61},"17","Control 17","Incident Response Management",{"family":102,"item":103,"code":104,"title":105,"together":61},"nist-800-53","ac-2","AC-2","Account Management",{"family":107,"item":108,"code":109,"title":110,"together":66},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",{"family":112,"item":113,"code":114,"title":114,"together":66},"itil","overview","ITIL",{"family":102,"item":116,"code":117,"title":118,"together":66},"at-2","AT-2","Literacy Training and Awareness",{"family":87,"item":120,"code":121,"title":122,"together":123},"6","Control 6","Access Control Management",4]