ShinyHuntersG1057 ↗
Has used spearphishing emails with malicious links to gain initial access and credentials.1
tfMITRE ATT&CK sub-technique
Spearphishing Link T1598.003
sub-technique of T1598 Phishing for Information
- Tactic
- Reconnaissance
- Platform
- PRE
- Version
- 1.7
- Created
- 02 October 2020
- Last modified
- 12 May 2026
- Contributors
- Philip Winther; Sebastian Salla, McAfee; Menachem Goldstein; Robert Simmons, @MalwareUtkonos; Elpidoforos Maragkos, @emaragkos; Joas Antonio dos Santos, @C0d3Cr4zy; Austin Herrin; Obsidian Security; Sam Seabrook, Duke Energy
Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
16
Threat groupsTop 11%
Threat groups89th percentile · 89% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Spearphishing Link MITRE reference T1598.003
Top 11%of all ATT&CK techniques for number of groups
16 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Moonstone SleetG1036 ↗
Used spearphishing messages containing items such as tracking pixels to determine if users interacted with malicious messages.1
Star BlizzardG1033 ↗
Has sent emails to establish rapport with targets eventually sending messages with links to credential-stealing sites.1234
Scattered SpiderG1015 ↗
Has used domains mirroring corporate login portals to socially engineer victims into providing credentials.1
CURIUMG1012 ↗
Used malicious links to adversary-controlled resources for credential harvesting.1
Mustang PandaG0129 ↗
Has delivered web bugs to profile their intended targets.1
All 16 groups for this technique · 6 newest in this preview
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
evilginx2S9003 ↗
Can generate and display phishing URLs including hidden tracking pixels and can also embed URLs within iframes for browser-in-the-browser phishing.123
AADInternalsS0677 ↗
Can send phishing emails containing malicious links designed to collect users’ credentials.1
SMOKEDHAMS0649 ↗
Has been delivered via malicious links in phishing emails.1
All 3 software entries for this technique
Offense vs defense T1598.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Spearphishing Link detection strategy DET0878
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Spearphishing Link
1 platform
AN2010 · PRE
Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed. Monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links and identifying obfuscated URLs) can also help detect links leading to known malicious sites.
Furthermore, monitor browser logs for homographs in ASCII and in internationalized domain names abusing different character sets (e.g. Cyrillic vs Latin versions of trusted sites).
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.
Monitor and analyze traffic patterns and packet inspection associated to protocol(s), leveraging SSL/TLS inspection for encrypted traffic, that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).
Furthermore, monitor network traffic for homographs via the use of internationalized domain names abusing different character sets (e.g. Cyrillic vs Latin versions of trusted sites). Also monitor and analyze traffic patterns and packet inspection for indicators of cloned websites. For example, if adversaries use HTTrack to clone websites, Mirrored from (victim URL) may be visible in the HTML section of packets.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | Application Log | None |
| Network Traffic FlowDC0078 | Network Traffic | None |
| Network Traffic ContentDC0085 | Network Traffic | None |
Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation. Furthermore, policies may enforce / install browser extensions that protect against IDN and homograph attacks. Browser password managers may also be configured to only populate credential fields when the URL matches that of the original, legitimate site.
User TrainingM1017
Users can be trained to identify social engineering techniques and spearphishing attempts. Additionally, users may perform visual checks of the domains they visit; however, homographs in ASCII and in IDN domains and URL schema obfuscation may render manual checks difficult. Phishing training and other cybersecurity training may raise awareness to check URLs before visiting the sites.