T1566.002: Spearphishing Link

Initial Access Intelligence Profile

AI Answer

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files (Source: MITRE ATT&CK T1566.002)

Confidence: 0.9 · Source: MITRE ATT&CK · Requires review: yes · Freshness: 2026-09-07

ATT&CK Mapping

Field	Value
Technique ID	T1566.002
Name	Spearphishing Link
Tactic	Initial Access (initial-access)
Platforms	Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
Sub-technique	Yes

Why it matters

In the OpenTrojan knowledge graph, Spearphishing Link (T1566.002) is one of the highest-connectivity ATT&CK techniques: 86 MITRE STIX relationships reference this technique; 46 threat groups observed using it; 31 software families associated; 9 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1566.002). Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an “IDN homograph attack”). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, hxxp://google.com@1157586937. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.

Detection

Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.

Mitigation

Restricting web-based content involves enforcing policies and technologies that limit access to potentially malicious websites, unsafe downloads, and unauthorized browser behaviors. This can include URL filtering, download restrictions, script blocking, and extension control to protect against exploitation, phishing, and malware delivery. This mitigation can be implemented through the following measures:

Deploy Web Proxy Filtering:

Use solutions to filter web traffic based on categories, reputation, and content types.
Enforce policies that block unsafe websites or file types at the gateway level.

Enable DNS-Based Filtering:

Implement tools to restrict access to domains associated with malware or phishing campaigns.
Use public DNS filtering services to enhance protection.

Enforce Content Security Policies (CSP):

Configure CSP headers on internal and external web applications to restrict script execution, iframe embedding, and cross-origin requests.

Control Browser Features:

Disable unapproved browser features like automatic downloads, developer tools, or unsafe scripting.
Enforce policies through tools like Group Policy Management to control browser settings.

Monitor and Alert on Web-Based Threats:

Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity.
Configure alerts for access attempts to blocked domains or repeated file download failures.

Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.

TrickBot
Bumblebee
Havoc
Pony
ROAMINGHOUSE
NETWIRE
Emotet
Squirrelwaffle
Snip3
GuLoader
Mispadu
SocGholish

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

Elderwood
APT3
Mustard Tempest
Kimsuky
EXOTIC LILY
TA577
Patchwork
Evilnum
APT32
MuddyWater
Storm-1811
FIN7

Group associations are from MITRE ATT&CK STIX relationships.

Operation Dream Job
RedDelta Modified PlugX Infection Chain Operations
Operation Dust Storm
Operation Spalax
C0021
Pikabot Distribution February 2024
Operation AkaiRyū
Night Dragon
C0011

Campaign associations are from MITRE ATT&CK STIX relationships.

References

Source Attribution

Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review

Start Investigation

Move from reading to investigating T1566.002 Spearphishing Link. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about T1566.002 Spearphishing Link?
Evidence — assertions mapped to verifiable references.
Timeline — events in chronological order.
Related Entities — CVE, threat actor, campaign, malware links.
Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace