Hoxhunt threat research

A working map of how phishing actually happens

PH!SH classifies phishing and social engineering in three layers: the mechanics of the attack, the story the message tells, and the action it asks for. Every entry carries a stable ID, so you can tag an incident, build a simulation, or report a trend.

Entries map to MITRE ATT&CK® where a connection exists. Open any entry to see the crosswalk.

TE

Techniques

How the attack is built, delivered, and hidden

Sender Spoofing

Spoofed Sender Domain

The sender address shows a real organization's domain, the part after the @, but the message didn't come from that organization's mail servers. Forging it makes the address look genuine, down to the last character.

Forged Email Routing Headers

The message's routing headers, the hidden record of which mail servers handled it, contain invented or altered entries. A faked trail can disguise where the message really came from.

Display Name Spoofing

The sender name shown in your inbox presents a trusted person, organization, or email address that differs from the actual sending address. Many email apps show the name first, or only the name.

Email Origin

Email Local Part Stuffing

The part of the sender address before the @ holds a trusted name or long padding, as in "[email protected]". It draws attention away from the real domain after the @.

Public Email Service Sender Address

The sender address is on a public email service, such as Gmail or Outlook.com, that anyone can sign up for. Organizations usually email from addresses under their own name, so this stands out.

Look-Alike Sender Domain

The sender address uses a domain, the part after the @, made to resemble a trusted one through a misspelling, added words, or a misleading prefix. It can make the sender look right at a glance.

Legitimate Service Notification Abuse

The message was genuinely sent by a known online service, but the request inside it was written by someone other than the service. Real service emails look familiar and can pass the checks that confirm who sent them.

Compromised Internal Email Account

The message came from a real mailbox in your own organization that an attacker had taken over or misused. A colleague's genuine account can pass the checks that confirm who sent a message, and is easy to trust.

Compromised External Email Account

The message came from a real mailbox at another organization, such as a supplier or partner, that an attacker had taken over. It can look genuine and even continue real conversations.

Attacker-Controlled Sending Domain

The domain the message came from, the part after the @, was registered, bought, or run by attackers. Owning a domain lets them set up the checks that confirm who sent a message, so their emails can pass.

Compromised Sending Infrastructure

The message was sent through a real mail server or email service admin account that an attacker had taken over. Email sent this way carries genuine sender details and can pass the checks that confirm who sent it.

Visual Deception

Right-to-Left Rendering Abuse

Hidden characters or formatting reverse the order of text or a file name, for example making a name that ends in ".exe" display as if it ends in ".pdf". It makes content or a file type look like something else.

Browser-in-the-Browser Window

The page showed a pop-up browser window built inside the page itself, complete with a title bar and address bar. The address in it is just part of the page, so it can show any site's name.

Fake Email Banner

The message contains a banner claiming it was scanned, verified, or sent from inside your organization, and that banner was added by the sender. It copies the look of real security labels to borrow their trust.

Double File Extension

A file name ends in two file types, as in "invoice.pdf.exe", and only the last one decides what the file really is. The first makes the file look like a familiar, harmless type.

Deceptive Link Destination

A link in the message is presented so it seems to lead to one place while it actually leads to another. Disguising the destination makes the link look familiar or trusted.

Fake Attachment

What looks like an attached file in the message body, with a file icon, name, or size, is a link or linked image, and nothing matching is attached. Clicking it opens whatever web address it points to.

Social Engineering

Reply Solicitation

The message opens with a small ask, such as checking whether you're available or asking you to get in touch, with no real request yet. An easy first reply is often how a longer conversation starts.

Emotional and Behavioral Manipulation

The message uses an appeal, such as a deadline, a threat, a reward, or a claim of authority, to get you to act. Appeals like these can prompt action before a request gets checked.

Personalization

The message includes details specific to you, such as your name, role, colleagues, or organization, beyond a normal greeting. Attackers use personal details to make a message look relevant and expected.

Multi-Stage Social Engineering

The exchange started with a harmless-looking first contact and later moved to a more sensitive or risky request. Attackers build up a conversation first so the later request looks like a natural next step.

Fake Email Thread

The earlier conversation quoted in the message was made up to look like a real exchange. Attackers invent threads so a request appears to have already been discussed or agreed.

Credibility-Building Attachments

Besides the main file or request, the message includes extra harmless-looking attachments, such as documents that back up its story. Attackers add these to make the message look complete and credible.

Live Chat Social Engineering

The conversation continued in a live chat that replied in real time and moved toward a disclosure, payment, or other step. Chat lets attackers answer questions and guide the recipient step by step.

Trust-Building Framing

The message's wording presents the request as familiar, understanding, credible, or routine. Attackers use a reassuring presentation to make a request look ordinary and safe to go along with.

Manual Command Execution Pretext

The message or a linked page presents an error or check and tells you to copy, paste, or run a command to fix it. A pasted command runs with your access, and the story makes that step feel routine.

Hijacked Email Thread

A real earlier email conversation was reused or continued to introduce a new request. Attackers join genuine threads so their request looks like part of an existing, trusted exchange.

Synthetic Media Impersonation

The voice, video, or image of a real, identifiable person was generated or altered to make them appear to speak, ask, or take part, often called a deepfake. It borrows that person's credibility.

Multi-Persona Corroboration

The message shows two or more people supporting or confirming the same request, such as a manager and a colleague both approving it. Attackers add extra voices to make a request look agreed and proper.

The mailbox received a flood of unwanted emails connected to this attack, as a distraction or as the reason for an offer of help. Attackers use floods to bury important alerts or make support calls feel timely.

Recipient Targeting

Recipient Identifier Pre-Population

The page or file behind the message already showed your email address or username before you typed anything. Seeing your own details can make a page feel expected and familiar.

Recipient Identifier in Link

A link in the message contains your own email address, username, or name, either readable or in a coded form. A link built for one recipient can let the linked page know who opened it.

Recipient Reconnaissance

The message was sent to check whether your address is active, or whether you open or answer emails, a step known as reconnaissance. Replies, opens, and bounces help attackers decide whom to email next.

Payload Delivery

Malicious Phone Number

The message, or a file attached to it, gives a phone number and makes calling it the next step. A number has no link or file for email filters to inspect, so it can pass as ordinary contact details.

Malicious Attachment

The message is built around a file attached to it, and opening that file is usually the step it leads to. A file can carry content, such as links or code, that only shows once it's opened.

The message includes a link and makes opening it the next step. A link can lead to a sign-in page, a download, or a form, and where it really goes isn't always visible from the message.

Malicious QR Code

The message contains a QR code that leads somewhere, such as a web page. Scanning it moves the visit to a phone, often outside the protections of a work computer.

The message, or a page or file it leads to, gives steps for running code on your device, such as a command, script, or program. Code you start yourself runs with your access, which is why attackers ask for it.

Malicious Email Address

The message gives an email address to send your response to, as the sender, as the reply-to address, or in its text. Whoever controls that address is the one who actually receives what you send.

Malicious Messaging Contact

The message gives a messaging contact, such as a WhatsApp number, Telegram handle, or chat invite, for continuing the conversation. Moving to a chat app takes the exchange out of view of email security.

Third-Party Content Hosting

The message leads you to a document, page, or file stored on a well-known service, such as Google Drive, Dropbox, or SharePoint. Real files are shared this way too, but links to trusted services are seldom blocked.

Data Harvesting

Adversary-in-the-Middle Authentication Proxy

The sign-in page sat between visitors and the real service, passing along whatever was entered. A relay like this can capture passwords, one-time codes, and the signed-in session, even with two-step verification on.

Direct Data Harvesting

A page or form presented by the message collects sensitive information, such as sign-in details, payment details, or identity documents. What people type in goes to whoever runs the form.

Reply-Based Data Collection

The message asks for sensitive information, such as documents, account details, or records, to be sent back by reply or to a given email address. Attackers use replies to collect data without a web page.

Access Delegation

OAuth Consent Phishing

The message or a page it leads to asks you to approve an app's access to your account on a real sign-in provider's permission screen. An approved app can keep that access without needing your password.

Device-Code Phishing

The message gives you a code to enter on a real sign-in page for connecting devices. Entering it can sign a device the sender controls in to your account.

Device-Linking Phishing

The message or a page it leads to asks you to link your account to another device, for example by scanning a code to pair a messaging app. Completing it can connect the account to a device the sender controls.

Wallet Connection or Signing Request

The message or linked page asks you to connect a cryptocurrency wallet, approve a permission, or sign a transaction. Approving can let the requester move the wallet's funds without any password being shared.

Obfuscation and Evasion

Detection Evasion

The message is built to keep some of its content from being read by automated security checks. What those checks see can differ from what the person reading the message sees.

Human Verification Gate

Before showing more content, the page asked visitors to prove they're human, for example with a CAPTCHA puzzle. Attackers often put checks like this in front of their pages to hold back automated scanners.

Conditional Content Delivery

The link or page shows different content depending on the visitor's location, device, or presence on an expected list. Attackers do this to hide their pages from security scanners.

Prompt Injection

The message contains instructions aimed at AI tools that analyze it, such as telling them to ignore evidence or change their result. Attackers add these to try to mislead automated email analysis.

Contact Method

The request reached you by email, rather than by text, chat, or phone call. Other findings for this message describe what it contains or asks for.

The request arrived as a text message (SMS) instead of an email. Text messages reach phones directly and often face fewer security checks than email.

Voice-Call Delivery

The request came through a voice call, including calls made over the internet. Attackers use calls to talk people through a request in real time, away from email security.

Contact Form Delivery

The request was submitted through a website's contact form and delivered by that site's own notification system. Attackers use contact forms because the resulting emails come from a real, trusted website.

Instant Messaging Delivery

The request arrived through a messaging app, a social media direct message, or a workplace chat. Attackers use chat because it's informal and often has fewer security checks than email.

Sender Spoofing3 techniques

Email Origin8 techniques

Visual Deception6 techniques

Social Engineering13 techniques

Recipient Targeting3 techniques

Payload Delivery8 techniques

Data Harvesting3 techniques

Access Delegation4 techniques

Obfuscation and Evasion4 techniques

Contact Method5 techniques

Nothing fits? TE0000 Other is the catch-all.

TH

Themes

The story the message tells the recipient

Service Impersonations

Media Service Impersonation

The message appears to come from a media company, such as a streaming service, broadcaster, or news publisher, speaking about its service or content. A familiar media brand can make an unexpected request feel routine.

Email Service Impersonation

The message claims to come from an email provider, mailbox administrator, or email-sending platform about a mailbox, account, or sending service. Mail warnings are a common way to push people toward a fake sign-in page.

Cryptocurrency Service Impersonation

The message claims to come from a cryptocurrency service, such as an exchange, a wallet, or another blockchain service. Alerts and offers are used to get people to sign in, share wallet access details, or send funds.

Travel Service Impersonation

The message presents itself as a travel company, such as a hotel, tour operator, airline, or other transport service. Trip details and booking deadlines give attackers a believable reason to ask for payment or details.

Document Sharing Service Impersonation

The message claims to come from a file-sharing or document service, announcing a shared file, an access request, or a permission change. Shared files are a common way to lead people to a fake sign-in page.

Logistics Service Impersonation

The message claims to come from a postal service, courier, or shipping company about a parcel, delivery, or customs charge. Delivery companies send these too, so a parcel's status is worth checking in their own app.

Financial Institution Impersonation

The message claims to come from a bank, credit union, or payment provider about your account, a transaction, or a verification check. Routine bank notices make requests to sign in or share payment details seem ordinary.

Social Media Service Impersonation

The message uses the name of a social media platform to write about your account, verification, content, or ads. A warning about losing an account, or a promised verified badge, can push people to a fake sign-in page.

Microsoft Impersonation

The message presents itself as coming from Microsoft, or from your Microsoft account, about the services you use. One Microsoft sign-in can give access to work email, files, and chats, so attackers often ask for it.

Website and Domain Hosting Service Impersonation

The message presents itself as a notice from a web host or domain registrar about a renewal, expiry, billing, or suspension. A website or domain about to go offline is a pressing reason to pay or sign in quickly.

AI Service Impersonation

The message appears to come from an AI service provider about a subscription, account, or billing. Paid AI tools give attackers a believable reason to ask for a sign-in or payment details.

Telecommunications Service Impersonation

The message claims to come from a mobile, phone, or internet provider about your account, bill, refund, or subscription. Nearly everyone has one, so a billing or refund notice can seem expected.

Benefits Service Impersonation

The message appears to come from an employee benefits or perks provider about entitlements, enrollment, or claims. News about benefits you might gain or lose draws attention and can be used to ask for personal details.

Collaboration Platform Impersonation

The message is presented as a notification from a collaboration or meeting platform, such as Microsoft Teams, Zoom, or Slack. These tools send many notices a day, so one more can be acted on without a second look.

Utility Service Impersonation

The message presents itself as an energy or utility provider writing about a bill, account, supply, or disconnection. A warning about losing power or water gives attackers a reason to ask for immediate payment.

Apple Impersonation

The message uses the name of Apple, or of your Apple ID or Apple account, as the account behind your devices and services. An Apple account can hold saved payment methods, photos, and device access.

Google Impersonation

The message claims to be from Google, or from your Google account, about the services you use. One Google account often opens email, files, and saved passwords, so its notices draw quick attention.

Enterprise System Impersonation

The message presents itself as a notice from a business application, such as a finance, workflow, or records system. Approvals, records, and tasks look like everyday work and can prompt a quick sign-in or approval.

Health Service Impersonation

The message appears to come from a healthcare provider, health insurer, lab, or patient portal. Test results, appointments, and claims are personal and time-sensitive, which makes them a strong reason to click or reply.

Retail and Marketplace Service Impersonation

The message presents itself as an online store or marketplace, such as Amazon, about an order, return, or seller account. Order problems and refunds give attackers a familiar reason to ask for account or payment details.

Educational Institution Impersonation

The message claims to come from a school, university, or student service about enrollment, tuition, or records. Fee and enrollment deadlines give attackers a reason to ask students or parents for payment or a sign-in.

Electronic Signature Service Impersonation

The message claims to be from an e-signature service, such as Docusign, with a document to sign, a reminder, or a completion notice. Signing requests look routine and time-bound, which makes them a common lure.

Job Portal Impersonation

The message presents itself as a job board or recruitment platform, such as LinkedIn, about your account, an application, or a listing. Job seekers and recruiters expect these notices, so they can pass as routine.

Insurance Service Impersonation

The message appears to come from an insurer or insurance broker about a policy, premium, claim, or payout. Renewals and payouts give attackers a reason to ask for payment or bank details.

Institutional Impersonations

Professional Adviser Impersonation

The message claims to come from an outside firm, such as a consultancy, auditor, or law firm, working on a matter that involves you. A firm's authority can make a request for payment or confidential details seem normal.

Internal Sender Impersonation

The message claims to come from someone inside your organization, such as a colleague or a department. A familiar internal sender can make an unusual request feel like routine work.

Government Entity Impersonation

The message claims to come from a government body, such as a court, agency, ministry, or municipal office. Official authority and possible legal consequences add weight to a request for payment or personal details.

Deceptive Offers and Promotions

The message is about hiring, such as a job opportunity, an interview, onboarding, or a job application. Hiring stories make replying, opening files, and sharing details feel like normal steps.

Advance Fee Scheme

The message offers you money, returns, credit, or another windfall. Offers like this are often used to start contact that can lead to requests for fees, payments, or personal details.

Deceptive Product or Service Offer

The message offers goods, a discount, or a service, but the seller can't be identified or doesn't match the sender. Offers like this are used to get people to pay or to share card or personal details.

Publication Submission Invitation

The message invites you to submit research to a journal or publisher that doesn't match the sender or your field, sometimes with a fee or sign-in. These invitations are used to collect fees, accounts, or research.

Adult Content or Services Offer

The message advertises adult content, adult services, or an adult dating or contact site. These offers are used to get people onto sites that ask for payment, sign-ups, or personal details.

Loyalty Rewards Notice

The message is about your loyalty points or rewards, such as points about to expire, a reward to redeem, or a new tier. Attackers use rewards to get people to sign in or enter card details to claim them.

Financial Deception

The message presents an invoice, bill, order, charge, or subscription to review, pay, dispute, or cancel. Billing stories look routine and seem to need prompt attention, which makes them a common choice for attackers.

Procurement Request

The message presents business purchasing, such as supplier registration, a request for a quote, or a purchase order. Purchasing stories are used to get staff to open files, sign in, or share internal details.

Contact List Sales Offer

The message offers to sell attendee lists or business-contact databases, claiming ties to an event or organization the sender doesn't appear connected to. These offers are used to get payments, replies, or clicks.

Cryptocurrency Balance Claim

The message says a cryptocurrency balance, deposit, or withdrawal is waiting for you, without anything you did to earn it. The aim is usually to get people to sign in, share wallet details, or pay a fee to withdraw it.

Vendor Payment Redirection Request

The message appears to come from an existing supplier and gives new bank details or payment instructions. This story is used to redirect routine payments, so changes are worth confirming through a known contact.

Payroll Payment Redirection Request

The message asks to change where salary or other payroll payments are sent. A request like this can redirect someone's pay, so it's worth confirming with that person through a known channel.

Gift Card Purchase or Code Request

The message asks you to buy gift cards or vouchers, or to send their codes, for a reason the sender gives. Gift card codes work like cash and are hard to trace or recover, which is why they're requested.

Refund or Rebate Offer

The message says you're owed money back, such as a refund, rebate, tax adjustment, or overcharge correction. Attackers use promised refunds to get people to enter bank, card, or personal details to claim them.

Incoming Payment Notice

The message says a payment has been sent or scheduled to you and offers a confirmation or remittance advice. Checking a payment record seems routine, so a link or file to view it can draw a quick click.

Overpayment Return Request

The message claims the recipient received too much, a duplicate, or a misdirected payment and asks for the excess back. This story is used to get money sent to attackers, so it's worth checking against payment records.

Payment Information Update

The message asks you to add, confirm, or update the card or payment details on your own account, often after a failed charge. A failed charge gives a believable reason to ask for card or bank details through a link.

The message claims the recipient owes a fine, penalty, or toll, for example for parking, traffic, customs, or taxes. Attackers use claimed fines to get people to pay quickly or enter card details.

Social Manipulation

Extortion Threat

The message threatens to expose, report, or harm someone unless the recipient pays or does what it asks. Threats like this push for fast payment or compliance, whether or not the sender holds what they claim.

Romantic or Dating Approach

The message shows romantic interest in you or suggests a relationship or date. Personal attention like this builds trust over time, which can later lead to requests for money or personal details.

The message's story is built on a deliberately false claim about news, events, or facts. Attackers use false stories to make a message seem timely and to get people to act on it.

Charity or Donation Request

The message asks you to donate money, goods, or support to a charity, relief effort, or fundraiser. Real charities ask for donations too, but it's worth giving through the charity's own website.

Friend or Family Impersonation

The message claims to come from a relative, friend, or acquaintance, often with a new number, a lost phone, or an urgent problem. Personal ties are used to get people to reply or help quickly.

Communications Deception

Voicemail Notification

The message says you have a new voicemail or a missed call waiting. Playing the recording usually means clicking a link or opening a file, which is why attackers use voicemail notices.

Fax Notification

The message says a fax has arrived and is ready to view. Attackers use fax notices because a document waiting for you is a natural reason to click a link or open an attachment.

Survey or Feedback Request

The message asks you to take a survey, answer a questionnaire, or give feedback, sometimes with a reward. Surveys are used to get people to click through and share personal or account details.

Secure Message Notification

The message says a confidential or encrypted message is waiting and explains how to open it. The extra steps needed to read one make a sign-in or download seem normal.

Meeting or Event Notice

The message invites you to a meeting, webinar, conference, or training, or shares a meeting recording or summary. Attackers use invitations because joining, registering, and viewing recordings often start with a click.

Technical Support Pretext

The message claims there's a problem or infection on a device, software, or account and offers help from support staff. Attackers use this to get people to call, reply, or follow their instructions.

Employment Terms and Compensation Notice

The message is about your pay or employment terms, such as salary, a payslip, benefits, working hours, or your contract. Attackers use pay topics to get people to sign in or open files to see the details.

Workplace Policy or Training Acknowledgment

The message asks employees to read, sign, or acknowledge a workplace policy, or to complete mandatory training. Required tasks like these are used to get people to sign in or open documents.

Adverse Employment Notice

The message announces an employment matter such as discipline, termination, layoffs, or restructuring affecting the recipient or their organization. Serious workplace news can prompt a quick click to read the details.

Document Review or Signature Request

The message offers a document, such as a contract, report, or shared file, to open, review, approve, or sign. Opening a file or link is a normal part of work, which makes shared documents a common story.

Customer Support Case or Complaint

The message appears to come from a customer reporting a problem, complaint, warranty issue, or dispute for your business to handle. Attackers use complaints because staff are expected to open the details and respond.

Team or Task Assignment Notice

The message says you've been added to a team, group, channel, or project, or assigned a task or ticket. Attackers use these notices because opening the item usually starts with a click on a link.

System Notices

Storage Quota Warning

The message says a mailbox, drive, or account is full or over its storage limit. Attackers use storage warnings to rush people into signing in or clicking to free up space or keep mail flowing.

Security Update Notice

The message announces or asks for a security update, such as a patch, a protective change, or a new security policy. Attackers use security updates as a reason to get people to click, sign in, or download files.

Quarantined Email Notice

The message says incoming emails are held in quarantine, blocked, or waiting for your review. Missing mail feels urgent, and releasing held mail usually starts with a click, which makes these notices a common story.

Email Delivery Failure Notice

The message says an email you sent couldn't be delivered, bounced, or needs to be resent. Attackers use bounce notices because they look like routine system mail and invite a quick click to check or resend.

Account Notices

Password Expiration Notice

The message says your password is expiring or has expired and may ask you to renew or keep it. A deadline like this is used to rush people into signing in.

The message is about two-step verification (MFA), such as setting up, resetting, or approving a second sign-in step. These stories are used to get people to share codes or approve sign-ins.

Account Suspension or Deletion Notice

The message says an account, page, or service is or will be suspended, restricted, or deleted, or must be revalidated to stay active. The threat of lost access is used to rush people into signing in.

Suspicious Sign-In Alert

The message claims a sign-in to your account was attempted, was unrecognized, or came from a new device or location. Alerts like this are used to rush people into signing in or resetting a password.

Account Details Update

The message asks you to update, correct, or confirm details such as contact information or other account details. Attackers use routine-looking updates to get people to enter personal details or sign in.

Account Verification Request

The message asks you to activate, sign in to, or verify an account. Real services send these too, but it's worth confirming by going to the service directly.

Copyright or Platform Policy Violation Notice

The message claims a copyright, trademark, content, or platform policy violation and asks for review, appeal, or a fix. Attackers use violation notices to push people to sign in or open evidence files.

Data Breach Notice

The message claims your data, password, or account may have been exposed in a breach and invites you to check or secure it. Breach claims are used to rush people onto pages that ask for a sign-in or personal details.

Service Impersonations24 themes

Institutional Impersonations3 themes

Deceptive Offers and Promotions6 themes

Financial Deception12 themes

Social Manipulation5 themes

Communications Deception12 themes

System Notices4 themes

Account Notices8 themes

Nothing fits? TH0000 Other is the catch-all.

CTA

Calls to action

What the message asks the recipient to do

Calls to action

The message asks you to click a link or button, or to visit a web address it gives. Links take people out of the message to a web page, where the rest of the request usually continues.

The message asks you to pay, refund, or transfer money, for example by bank transfer, cryptocurrency, or a payment app. Attackers often ask for payment methods that are fast and hard to reverse.

The message asks you to scan a QR code, usually with a phone camera. A QR code hides its web address until it's scanned, and phones often have less security protection than work computers.

The message asks for a response, such as confirming you're available, answering a question, or sending records or gift card codes. Attackers use replies to start a conversation or collect information directly.

The message asks you to call a phone number it gives, for example to cancel a charge or get support. A live caller can answer doubts and guide each step, away from email security checks.

Open Attachment

The message asks you to open or review a file attached to it. Attackers use attachments to carry content such as links, QR codes, or code outside the main text of the message.

The message doesn't ask or invite the recipient to do anything, as with a purely informational notice. Other findings for this message can still describe what it contains.

Contact via Messaging Service

The message asks you to start or continue a conversation on a messaging service, using a number, handle, or invite it gives. Attackers move conversations to chat apps, which often have fewer security checks.

Change Payment Destination

The message asks to change stored or future payment details, such as a supplier's bank account or where a salary is paid. Real changes happen, but it's worth confirming them through a known contact.

The message tells you to run, paste, or execute a command, script, or code, or to enable content so that code runs. Code run this way gets the same access to the device as the person running it.

Nothing fits? CTA0000 Other is the catch-all.