T1566: Phishing
AI Answer
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. (Source: MITRE ATT&CK T1566)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1566 |
| Name | Phishing |
| Tactic | Initial Access (initial-access) |
| Platforms | Identity Provider, Linux, macOS, Office Suite, SaaS, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Phishing (T1566) is one of the highest-connectivity ATT&CK techniques: 11 MITRE STIX relationships reference this technique; 8 threat groups observed using it; 3 software families associated; 51 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1566). Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., “thread hijacking”). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Use intrusion detection signatures to block traffic at network boundaries.
Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.
Related Software
- Royal
- Hikit
- INC Ransomware
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- Kimsuky
- AppleJeus
- MuddyWater
- Sea Turtle
- Axiom
- GOLD SOUTHFIELD
- INC Ransom
- VOID MANTICORE
Group associations are from MITRE ATT&CK STIX relationships.
Related Content
References
- https://attack.mitre.org/techniques/T1566
- https://krebsonsecurity.com/2024/03/thread-hijacking-phishes-that-prey-on-your-curiosity
- https://www.cisa.gov/uscert/ncas/alerts/aa23-025a
- https://blog.cyberproof.com/blog/double-bounced-attacks-with-email-spoofing-2022-trends
- https://unit42.paloaltonetworks.com/luna-moth-callback-phishing
- https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam
- https://blog.sygnia.co/luna-moth-false-subscription-scams
- https://www.proofpoint.com/us/threat-reference/email-spoofing
- https://unit42.paloaltonetworks.com/examining-vba-initiated-infostealer-campaign
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1566 Phishing. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1566 Phishing?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.