PH!SH Framework
Framework / Techniques
Technique Payload Delivery

Malicious Email Address

The message gives an email address to send your response to, as the sender, as the reply-to address, or in its text. Whoever controls that address is the one who actually receives what you send.

Also known as
Aliases
  • Reply-To mismatch

Sub-techniques

TE0023.1 Look-Alike Reply-To Address
Replies to the message go to a reply-to address that differs from the sender shown. That address's domain, the part after the @, imitates a trusted name, so a reply can seem to go somewhere trusted.
TE0023.2 Public Email Service Reply-To Address
The message's reply-to address, where replies go, is on a public email service such as Gmail or Outlook.com. Anyone can create such an address, so replies can go to someone other than the apparent sender.
TE0023.3 Look-Alike Email Contact in Body
The message text asks you to write to an address whose domain, the part after the @, imitates a trusted name, for example with a misspelling or an extra word. It makes the contact seem to belong to that organization.
TE0023.4 Public Email Service Contact in Body
The message text asks you to write to an address on an email service anyone can sign up for, such as Gmail or Outlook.com. Organizations usually use addresses under their own name, so this stands out.

Connected in PH!SH

Themes
TH0015Billing Notice TH0016Procurement Request TH0046Enterprise System Impersonation TH0049Vendor Payment Redirection Request TH0050Payroll Payment Redirection Request TH0052Gift Card Purchase or Code Request TH0053Refund or Rebate Offer TH0054Incoming Payment Notice TH0055Overpayment Return Request TH0066Payment Information Update TH0071Penalty Notice