Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Initial Access/ T1566.002

T1566.002Spearphishing Link

T1566.002 — Spearphishing Link is a MITRE ATT&CK technique in the Initial Access tactic. Clankerusecase tracks 44 detection use cases covering it and 180 threat-intel articles citing it.

Initial Access
View on the matrix → Filter Detection Library MITRE official spec ↗
44Use cases
180Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1566 · Phishing

Use cases covering this technique (44)

Phishing-link click correlated to endpoint execution Internal delivery · alerting DSP User clicked through a Safe Links warning page Internal delivery · alerting DS Click on URL whose host doesn't match the sender domain Internal delivery · hunting DS [WEEKLY] Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes Internal delivery · alerting DSPDD [WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD Azure AD Device Code Authentication ESCU actions · alerting P O365 Email Reported By Admin Found Malicious ESCU actions · alerting P O365 Email Reported By User Found Malicious ESCU actions · alerting P O365 Threat Intelligence Suspicious Email Delivered ESCU actions · hunting P O365 ZAP Activity Detection ESCU actions · hunting P Process Creating LNK file in Suspicious Location ESCU actions · hunting P Windows Defender ASR Audit Events ESCU actions · hunting P Windows Defender ASR Block Events ESCU actions · hunting P Windows Defender ASR Rules Stacking ESCU actions · hunting P [LLM] DNS / web resolution of F6 counterfeit Russian-company domains Bespoke delivery · alerting DSΣPDDCS [LLM] Compromised M365 mailbox fan-out of QR-code PDF phishing (UAT-11764) Bespoke delivery · alerting DSP [LLM] ARToken/EvilTokens device-code phishing: contact with pamconj C2 and Cloudflare Workers lures Bespoke delivery · alerting DSΣPDDCS [LLM] Operation BlueDash fake Teams/Zoom update payload-host infrastructure contact Bespoke delivery · alerting DSΣPDDCS [LLM] InsureTrap malvertising: Google Ads referrer landing on free-hosting insurance phish Bespoke delivery · hunting DSΣP [LLM] BlueNoroff typosquatted Zoom/Teams infrastructure network contact Bespoke delivery · alerting DSΣPDDCS [LLM] ChatGPT AgentForger CSRF link: Agent Builder URL with initial_assistant_prompt param Bespoke delivery · alerting DSΣP [LLM] Inbound phishing email or URL referencing npm look-alike domain npmjs.help Bespoke delivery · alerting DSP [LLM] Endpoint DNS resolution or web connection to npm phishing domain npmjs.help Bespoke delivery · alerting DSΣPDDCS [LLM] mshta.exe HTA downloader reaching UAT-11795 staging domains (ClickFix) Bespoke delivery · alerting DSΣPDDCS [LLM] npm maintainer credential-phish lookalike domain npmjs.help (chalk/debug ATO) Bespoke delivery · alerting DSΣPDDCS [LLM] Entra ID Device Authorization Grant (device code) authentication flow sign-in Bespoke exploit · alerting DSΣPDD [LLM] Law-firm / order-confirmation lure delivering device-code phish via cacoo.com and allianceinvestigators.com Bespoke delivery · hunting DS [LLM] ARToken/EvilTokens PhaaS infrastructure contact (pamconj.com panel + Cloudflare Worker lure) Bespoke delivery · alerting DSΣPDDCS [LLM] Montana Empire phishing-kit ZIP + companion APK by SHA256 on endpoints Bespoke delivery · hunting DSΣPCS [LLM] Montana Empire kit PHP components staged on web infrastructure Bespoke install · hunting DSΣPDDCS [LLM] EvilTokens device-code token polling from attacker infra (python-requests UA / C2 IPs) Bespoke delivery · hunting DSΣPDD [LLM] EvilTokens device-code lure email (Acrobat/DocuSign decoy, 'Verify to view') Bespoke delivery · alerting DSP [LLM] BTMOB Android RAT APK SHA256 sighting in file or email telemetry Bespoke delivery · hunting DSΣPDDCS [LLM] Mail-borne click to fake FIFA World Cup 2026 phishing domain Bespoke delivery · alerting DSΣPDDCS [LLM] Hoppscotch device-login open redirect token theft via localhost.* / sslip.io bypass Bespoke exploit · alerting DSΣPDDCS [LLM] Silver Fox Japan tax-season lure: inbound email with Japanese HR/ESOP subject + gofile.io URL or RAR/ZIP Bespoke delivery · alerting DS [LLM] gofile.io archive download by browser followed by extracted-EXE execution within 30 minutes Bespoke install · alerting DS [LLM] PlugX phishing lure — 'Meeting Invitation' email linking to gesecole.net ZIP Bespoke delivery · hunting DSΣPDD [LLM] Phishing email impersonating npm support from typosquatted npmjs.help domain Bespoke delivery · alerting DSΣP [LLM] ESET-impersonating typosquat domain contact (InedibleOchotense / Kalambur delivery) Bespoke delivery · alerting DSΣPDDCS [LLM] Connection to Beamglea phishing credential-harvesting domains Bespoke actions · alerting DSΣPDDCS [LLM] Inbound phishing email from npmjs.help maintainer-takeover domain Bespoke delivery · alerting DSΣPDD [LLM] Browser/HTTPS traffic to npmjs.help credential-harvesting page Bespoke delivery · alerting DSΣPDDCS [LLM] npm registry typosquat npnjs.com — DNS / URL click (eslint-config-prettier maintainer phishing kit) Bespoke delivery · alerting DSΣPDDCS

Articles citing this technique (180)

crit Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet art-00
crit Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data art-01
high Four incident-response decisions from the Hugging Face breach art-04
crit Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads art-06
high Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare art-07
crit Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory art-12
crit Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape art-13
crit Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline art-18
high Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments art-19
crit Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser art-22
crit Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass art-26
crit OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach art-27
crit New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands art-28
crit Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates art-29
high CubePilot drone software dev hit by DNS hijacking to intercept traffic art-37
high Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process art-43
crit 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login art-44
crit JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach art-47
crit Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root art-48
crit Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays art-49
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-50
crit Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In art-51
crit Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit art-52
crit Mirage Kitten targets Middle East and Africa region with new malware art-53
crit Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw art-55
high NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework art-57
crit Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption art-58
crit Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw art-61
crit n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process art-63
high Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update art-64
crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware art-65
crit TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments art-66
high GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption art-67
high Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable art-71
crit Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available art-72
high Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git art-73
crit CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking art-74
crit Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE art-75
crit DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts art-76
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery art-96
crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller art-97
high ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link art-99
crit Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry art-102
crit Golden Chickens Resurfaces With Four New Malware Families and Modular Implants art-103
crit NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats art-104
crit Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say art-105
crit Email threat landscape: Q2 2026 trends and insights art-108
crit Russian Global Webmail Espionage art-111
high The upgrade trap: when upgrading is the wrong answer to a CVE art-119
high Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters art-131
high ACR Stealer: Two observed intrusion chains amid increased threat activity art-146
crit AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report art-147
crit Begun, the Patch Wars have art-150
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156
high Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery art-157
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-163
crit [GHSA / CRITICAL] CVE-2026-52881: MantisBT: Reflected XSS in admin/install.php via unescaped printf art-165
high Turning threat intelligence into decisive action with Defender Experts art-167
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-168
crit OkoBot: new sophisticated malware framework targets cryptocurrency users art-169
high The serpent’s tongue: Luring the Python out of its den art-180
high AsyncAPI npm packages backdoored via GitHub Actions art-181
crit What is a dependency firewall? art-192
crit No Manners Here: The Ruthless Rise of The Gentlemen Ransomware art-198
crit Winning 54% of the time art-214
crit ESET Threat Report H1 2026 art-221
crit Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation art-223
high Threat landscape for industrial automation systems. Q1 2026 art-228
crit When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website art-246
high Cyber readiness for SMBs: Getting the basics right art-249
crit Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign art-250
high How We Added WebAuthn to a Browser-Based RDP Client art-251
high Catan and Mouse art-261
high Multiple @immobiliarelabs Backstage Plugins Compromised on npm art-272
crit Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector art-280
high Inside the inbox: Why cybercriminals want to break into your email account art-285
high Threat Brief: Mitigating Large-Scale Credential Attacks art-289
crit CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure art-293
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-294
crit OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat art-302
high The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration art-312
crit Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE art-327
high EvilTokens: A phishing attack that doesn’t steal your password art-331
high npm v12 delivers one of the biggest security improvements in years art-339
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-350
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-351
crit Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp art-361
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-362
high Multiple redhat-cloud-services npm Packages compromised art-370
high What MDM can't protect on developer machines (and what to do about it) art-386
crit ESET APT Activity Report Q4 2025–Q1 2026 art-387
crit BTMOB: A stealthy RAT burrowing deep into Android devices art-397
med Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise art-402
crit The Wild West of VS Code extensions and how a poisoned extension breached GitHub art-411
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-422
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-425
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-427
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-428
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-435
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-442
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-446
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-456
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-458
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-466
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-469
high It's time to treat browser extensions like supply chain attack vectors art-477
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-483
crit New NGate variant hides in a trojanized NFC payment app art-491
crit What the ransom note won’t say art-492
high Aikido Attack finds multiple 0-days in Hoppscotch art-528
high As breakout time accelerates, prevention-first cybersecurity takes center stage art-530
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-535
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-542
crit litellm: Credential Stealer Hidden in PyPI Wheel art-545
high A cunning predator: How Silver Fox preys on Japanese firms this tax season art-548
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-551
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-565
crit EDR killers explained: Beyond the drivers art-577
crit GlassWorm Hides a RAT Inside a Malicious Chrome Extension art-580
crit Cyber fallout from the Iran war: What to have on your radar art-593
crit Sednit reloaded: Back in the trenches art-596
crit Protecting education: How MDR can tip the balance in favor of schools art-607
crit PlugX Meeting Invitation via MSBuild and GDATA art-615
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-640
crit Naming and shaming: How ransomware groups tighten the screws on victims art-645
crit Another npm Supply Chain Attack: The 'is' Package Compromise art-654
med Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan art-687
crit ESET Threat Report H2 2025 art-732
high SHA1-Hulud, npm supply chain incident art-766
med Why Threat Modeling Is Now Even More Critical for AI-Native Applications art-772
crit The who, where, and how of APT attacks in Q2 2025–Q3 2025 art-792
crit ESET APT Activity Report Q2 2025–Q3 2025 art-793
crit Phishing Campaign Leveraging the NPM Ecosystem art-823
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-852
high npm Supply Chain Attack via Open Source maintainer compromise art-855
high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-865
high Snyk Joins CISA's Secure by Design Pledge art-883
crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-894
low AI Trust in Action: How Snyk Agent Redefines Secure Development art-943
med Securing GenAI Development with Snyk art-1105
high The persistent threat: Why major vulnerabilities like Log4Shell and Spring4Shell remain significant art-1241
crit Polyfill supply chain attack embeds malware in JavaScript CDN assets art-1296
high Building an npm package compatible with ESM and CJS in 2024 art-1357
high Exploiting HTTP/2 CONTINUATION frames for DoS attacks art-1366
crit Snyk Learn and the NIST Cybersecurity Framework (CSF) art-1382
high Defense in Depth art-1391
crit New Year's security resolutions for 2024 from Snyk DevRel, SecRel, and friends art-1421
high Cybersecurity Venture’s 2023 Software Supply Chain Attack Report art-1538
high XS leaks: What they are and how to avoid them art-1640
high Ethical hacking techniques art-1698
high Ethical Hacking: Top Tools art-1702
crit API Security Guide art-1751
high Securing the web (forward) art-1803
crit The rising trend of malicious packages in open source ecosystems art-1804
high Cybersecurity Hygiene 101 art-1824
high OSPO security evolution: The Kübler-Ross Model of open source art-1866
crit Key points from Google and Accenture's ransomware white paper art-1935
crit Secure Python URL validation art-1937
crit Understanding DNS attacks: Identifying and patching vulnerabilities art-1949
high Avoiding SMTP Injection: A Whitebox primer art-2006
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2072
crit Targeted npm dependency confusion attack caught red-handed art-2273
high An unintimidating introduction to the dark arts of C/C++ vulnerabilities art-2297
med Snyk Open Source adds C/C++ security scanning for unmanaged dependencies art-2334
crit Alert: LaughTilYouCry ransomware sabotages npm package (with puns) art-2342
high How Snyk helps satisfy White House cybersecurity recommendations art-2454
high dompdf security alert: RCE vulnerability found in popular PHP PDF library art-2458
high Build a software bill of materials (SBOM) for open source supply chain security art-2477
med Getting started at a new organization art-2663
crit The Secure Developer: 2021 in review art-2691
high Snyk joins OpenSSF: Tackling open source supply chain security with a developer-first approach art-3066
high How Dun & Bradstreet and Shutterstock built successful security champions programs art-3068
high Use Snyk security policies to prioritize fixes more efficiently art-3107
crit What is typosquatting and how typosquatting attacks are responsible for malicious modules in npm art-3226
high Cheatsheet: top 10 application security acronyms art-3247
crit Demystifying HTTP request smuggling art-3335
high PCI standards open source security requirements — how to comply? art-3502
med Python 2 vs 3: Security Differences art-3632
crit XSS Attacks: The Next Wave art-3641
high Which of the OWASP Top 10 Caused the World’s Biggest Data Breaches? art-3644