Phishing

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services (like social media platforms) or delivered via calendar invites. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).¹² Another way to accomplish this is by Email Spoofing³ the identity of the sender, which can be used to fool both the human recipient as well as automated security tools,⁴ or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., "thread hijacking").⁵ Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,⁶⁷ or install adversary-accessible remote management tools onto their computer (i.e., User Execution).⁸

1. Microsoft OAuth Spam 2022
2. Palo Alto Unit 42 VBA Infostealer 2014
3. Proofpoint-spoof
4. cyberproof-double-bounce
5. phishing-krebs
6. sygnia Luna Month
7. CISA Remote Monitoring and Management Software
8. Unit42 Luna Moth

使用该技术的组织

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。