Internal Sender Impersonation
The message claims to come from someone inside your organization, such as a colleague or a department. A familiar internal sender can make an unusual request feel like routine work.
Mapped to
MITRE ATT&CK®
Sub-themes
TH0011.1
Company Executive Impersonation
The message claims to come from a senior executive at your organization, such as the CEO or CFO. Attackers use an executive's authority to ask for urgent payments, sensitive data, or confidential favors.
TH0011.2
IT Department Impersonation
The message claims to come from your organization's IT team or help desk. Because IT manages accounts and devices, attackers use its name to ask for passwords, sign-ins, or software to be installed.
TH0011.3
HR Department Impersonation
The message presents itself as coming from your organization's HR team. Emails from HR about pay, benefits, or policies get attention and can be used to ask for personal details or a sign-in.
TH0011.4
Finance Department Impersonation
The message claims to come from your organization's finance, accounting, or payroll team. A payment, bank-detail change, or invoice approval from that team can look like routine work.
TH0011.5
Coworker Impersonation
The message claims to come from one of your colleagues. A request from a familiar colleague can seem ordinary, which makes a quick favor, link, or file easier to accept.
TH0011.6
Manager Impersonation
The message appears to come from your manager or supervisor. A direct request from your manager carries weight, and attackers use it to ask for quick favors, payments, or information.