T1566.002: Spearphishing Link
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place.
Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack").CitationCISA IDN ST05-016 URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.CitationMandiant URL Obfuscation 2023
Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications.CitationTrend Micro Pawn Storm OAuth 2017CitationMicrosoft OAuth 2.0 Consent Phishing 2021 These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls.CitationMicrosoft OAuth 2.0 Consent Phishing 2021
Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.CitationSecureWorks Device Code Phishing 2021CitationNetskope Device Code Phishing 2021CitationOptiv Device Code Phishing 2021
Security context for executives and security teams
Spearphishing Link matters because it can bypass organizations that focus mainly on malicious attachments. The business risk is not just malware delivery: ATT&CK notes that links can lead to browser compromise, user-driven downloads, OAuth consent phishing, and device-code phishing that may grant access through identity and SaaS platforms. For leaders, this makes email, web, identity-provider, and SaaS visibility a combined resilience issue rather than a mail-filtering problem alone.
Executive priority
Prioritize this technique as an initial-access risk that tests whether security controls are integrated across email security, web access, endpoint response, and identity governance. Executives should ask whether the organization can prove it logs and investigates malicious links that result in downloads, token grants, suspicious OAuth consent, or device authorization activity. This is also useful audit evidence: user training, account management, web-content restrictions, software configuration, and auditing are all mapped mitigations for this behavior.
Technical view
For SOC, detection engineering, and IR teams, validate coverage across the full chain: spearphishing email received, link clicked or copied into a browser, redirected or obfuscated URL accessed, payload downloaded or browser exploited, and any resulting identity-provider or SaaS authorization event. Platforms listed by ATT&CK include Identity Provider, Linux, macOS, Office Suite, SaaS, and Windows. ATT&CK does not provide official detection text for this object, but the relationship to DET0107 indicates a detection strategy exists. Teams should tune for link-based delivery patterns, IDN homograph indicators, URL schema abuse such as text before an @ symbol or unusual numeric/hex host formats, and OAuth or device-code flows that produce new access tokens or application permissions.
Likely telemetry
- Email gateway and office-suite message logs, including sender, recipient, subject, embedded URLs, URL rewriting results, and user click events
- Web proxy, DNS, secure web gateway, and browser history records showing visited domains, redirects, downloads, and blocked categories
- Endpoint telemetry from Windows, macOS, and Linux showing browser-spawned downloads, archive/document execution, and follow-on process activity
- Identity-provider and SaaS audit logs for OAuth consent grants, device authorization events, new application permissions, access-token issuance, and API activity on behalf of users
- User-reported phishing submissions and helpdesk/security mailbox triage records
Detection direction
- Confirm that link-click telemetry is correlated with later endpoint, identity-provider, and SaaS events; email-only detection can miss consent phishing and device-code phishing outcomes.
- Review rules for obfuscated and deceptive URLs, including IDN homograph-like domains and schema quirks described in the ATT&CK references.
- Tune detections for suspicious OAuth consent and device authorization activity, especially when preceded by email links or unusual user interaction patterns.
- Account for false positives from legitimate marketing links, URL shorteners, collaboration tools, and normal OAuth application onboarding by using allowlists, business ownership, and user/context enrichment.
- Use the sub-technique relationship to T1566 Phishing and the revoked-by relationship from T1192 to keep legacy detections and reporting aligned to T1566.002.
Mitigation priorities
- Start with user training focused on recognizing and reporting link-based social engineering, including deceptive domains, unexpected downloads, OAuth consent prompts, and device-code requests.
- Restrict web-based content through URL filtering, unsafe download controls, and browser/content policy enforcement where appropriate.
- Strengthen user account management and least-privilege practices so a successful click or consent grant has limited reach.
- Harden software configuration for browsers, office-suite clients, and SaaS/identity settings that influence downloads, link handling, OAuth consent, and device authorization behavior.
- Maintain auditing for email, web, endpoint, identity-provider, and SaaS activity so incidents can be reconstructed and compliance evidence can be produced.
Additional notes and limits
The relationship context shows broad historical use across multiple campaigns and groups, and one cyber-physical-relevant example: Night Dragon targeted oil, energy, petrochemical companies and collected SCADA-related data. This should inform threat-modeling for critical infrastructure and operational technology stakeholders, but it should not be read as evidence of current exposure in any specific environment.
ATT&CK provides no official detection text for this object in the supplied fields. The assessment is therefore limited to the object description, platforms, initial-access tactic, external references, and listed relationships. Local control evidence is required to determine actual coverage, exposure, or incident likelihood.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Spearphishing Link
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place.
Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack").CitationCISA IDN ST05-016 URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.CitationMandiant URL Obfuscation 2023
Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications.CitationTrend Micro Pawn Storm OAuth 2017CitationMicrosoft OAuth 2.0 Consent Phishing 2021 These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls.CitationMicrosoft OAuth 2.0 Consent Phishing 2021
Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.CitationSecureWorks Device Code Phishing 2021CitationNetskope Device Code Phishing 2021CitationOptiv Device Code Phishing 2021
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.