Technique Payload Delivery

Malicious Link

Emails contain hyperlinks designed to trick victims into visiting credential-harvesting sites, downloading malware, or engaging with fraudulent content. These links may be disguised using text-based deception (e.g., misleading anchor text), obfuscation techniques, or URL redirection.

Mapped to

MITRE ATT&CK®

T1566.002Spearphishing Link T1598.003Spearphishing Link

Sub-techniques

TE0006.1 Open Redirect

Attackers exploit legitimate websites to route victims through trusted domains (e.g., google.com, sendgrid.net or youtube.com) before landing them on a phishing site. The redirect is visible in the email link as a redirect parameter in the URL (e.g., ?q=, ?url= or ?redirect=). This technique reduces suspicion and bypasses some security filters.

TE0006.2 URL Shortener

Attackers use third-party URL shortening services (e.g., bit.ly, tinyurl.com) to hide the actual URL. These services convert full URLs into short aliases. This technique intentionally hides the actual link, making it harder for users to assess the legitimacy of the link before clicking.

Connected in PH!SH

Themes