Legitimate Service Notification Abuse
The message was genuinely sent by a known online service, but the request inside it was written by someone other than the service. Real service emails look familiar and can pass the checks that confirm who sent them.
Also known as
- Aliases
-
- BEC 3.0
Mapped to
MITRE ATT&CK®
Sub-techniques
TE0056.1
Notification Field Hijack
An attacker put their own text into a field the service copies into its emails, such as a name, note, or comment, and had it sent to you. The notification is real, and the text is theirs.
TE0056.2
Service Workflow Misuse
The attacker used a service as any customer would, for example sending a signature request, file share, or calendar invite through it. The service works normally, and the risk is in what was sent.