[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1566":3},{"item":4,"lessons":18,"controls":69,"related":100},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1566","T1566","Phishing",160,"MITRE","**What attackers do.** Attackers send deceptive emails, messages or links that trick people into opening a malicious file, visiting a fake site or handing over credentials. It is one of the most common ways into an organisation and serves the Initial Access tactic.\n\n**How to defend.** Layer email security: filter attachments and links, enforce SPF, DKIM and DMARC, and sandbox or rewrite URLs at click time. Use phishing-resistant MFA so stolen passwords alone are not enough, and make it easy for staff to report suspicious messages with one click. Feed email gateway, proxy and endpoint telemetry into one place so a reported message can be traced to every recipient quickly.\n\n**Signs to look for.** Look for lookalike sender domains, newly registered domains in links, unexpected attachments such as archives, ISO or HTML files, and Office processes spawning scripts or shells. A common gap is not correlating a user's report with who else received and clicked the same message.","Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.\n\nAdversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services (like social media platforms) or delivered via calendar invites. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata\u002Fheaders from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\").\n\nVictims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},817,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"north-korean-actors-use-ai-deepfakes-and-social-engineering-to-steal-12b-in-crypto","North Korean Actors Use AI Deepfakes and Social Engineering to Steal $1.2B in Crypto","2026-11-13T22:21:35.043+00:00",{"slug":26,"title":27,"published_at":28},"gootloader-malware-enabled-44-ransomware-attacks-via-seo-poisoning-and-weak-endpoint-defenses","Gootloader Malware Enabled 44 Ransomware Attacks via SEO Poisoning and Weak Endpoint Defenses","2026-11-13T17:21:02.612+00:00",{"slug":30,"title":31,"published_at":32},"north-korean-deepfake-video-calls-drain-400m-in-crypto","North Korean Deepfake Video Calls Drain $400M in Crypto","2026-11-13T16:23:15.645+00:00",{"slug":34,"title":35,"published_at":36},"fake-gta-6-download-delivers-credential-stealing-malware","Fake GTA 6 Download Delivers Credential-Stealing Malware","2026-11-13T16:22:38.997+00:00",{"slug":38,"title":39,"published_at":40},"operation-endgame-dismantles-malware-as-a-service-infrastructure-stealing-millions-of-credentials","Operation Endgame Dismantles Malware-as-a-Service Infrastructure Stealing Millions of Credentials","2026-11-13T11:20:42.574+00:00",{"slug":42,"title":43,"published_at":44},"north-korean-deepfake-zoom-scam-steals-400m-using-victims-own-webcam-footage","North Korean Deepfake Zoom Scam Steals $400M Using Victims' Own Webcam Footage","2026-11-13T08:22:15.551+00:00",{"slug":46,"title":47,"published_at":48},"north-korean-social-engineering-nets-billions-from-crypto-exchange","North Korean Social Engineering Nets Billions From Crypto Exchange","2026-11-13T03:20:21.598+00:00",{"slug":50,"title":51,"published_at":52},"north-korean-social-engineering-campaign-steals-12b-via-fake-meetings-and-account-hijacking","North Korean Social Engineering Campaign Steals $1.2B via Fake Meetings and Account Hijacking","2026-11-13T01:20:21.778+00:00",{"slug":54,"title":55,"published_at":56},"north-korean-hackers-steal-16b-via-social-engineering-and-deepfakes","North Korean Hackers Steal $1.6B via Social Engineering and Deepfakes","2026-11-12T22:20:19.315+00:00",{"slug":58,"title":59,"published_at":60},"64-million-credentials-stolen-via-malware-kits-targeting-unsuspecting-users","6.4 Million Credentials Stolen via Malware Kits Targeting Unsuspecting Users","2026-11-12T17:20:38.235+00:00",{"slug":62,"title":63,"published_at":64},"turla-group-hijacks-exchange-servers-for-silent-email-espionage","Turla Group Hijacks Exchange Servers for Silent Email Espionage","2026-11-10T12:22:49.31+00:00",{"slug":66,"title":67,"published_at":68},"spyware-goes-mainstream-everyday-users-now-prime-targets","Spyware Goes Mainstream: Everyday Users Now Prime Targets","2026-11-10T12:22:28.417+00:00",[70,75,80,85,90,95],{"slug":71,"name":72,"problem":73,"stories":74},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",409,{"slug":76,"name":77,"problem":78,"stories":79},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",196,{"slug":81,"name":82,"problem":83,"stories":84},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",181,{"slug":86,"name":87,"problem":88,"stories":89},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",177,{"slug":91,"name":92,"problem":93,"stories":94},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",138,{"slug":96,"name":97,"problem":98,"stories":99},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",128,[101,107,113,119,125,131,136,142],{"family":102,"item":103,"code":104,"title":105,"together":106},"nist-800-53","si-2","SI-2","Flaw Remediation",610,{"family":108,"item":109,"code":110,"title":111,"together":112},"nist-csf","pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",601,{"family":114,"item":115,"code":116,"title":117,"together":118},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",528,{"family":120,"item":121,"code":122,"title":123,"together":124},"cis","14","Control 14","Security Awareness and Skills Training",468,{"family":126,"item":127,"code":128,"title":129,"together":130},"nis2","21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",456,{"family":120,"item":132,"code":133,"title":134,"together":135},"17","Control 17","Incident Response Management",429,{"family":137,"item":138,"code":139,"title":140,"together":141},"gdpr","32","Article 32","Security of processing",297,{"family":120,"item":143,"code":144,"title":145,"together":146},"7","Control 7","Continuous Vulnerability Management",264]