Academy
TermAttack

Phishing

Getting the user to click a link, open a file or enter information with a message that appears to come from a trusted organization or person.

Flow

  1. 1Impersonates
  2. 2Asks for action
  3. 3Runs the payload
Related families
Rhadamanthys, Katz Stealer, Lumma Stealer
MITRE ATT&CK
T1566 · Phishing
Sources
9 sources
01

Overview

NIST defines phishing as an attempt to lead people into giving sensitive information or taking a harmful action through fake messages posing as a trusted source. NIST CSRC

For infostealers, phishing serves two purposes: an email attachment or link installs the malware, while a fake login page collects the password directly. MITRE ATT&CK

02

How it works

  1. 1

    Impersonates

    A message is prepared that looks like an invoice, a delivery notice, a security alert or a well-known brand. MITRE ATT&CK

  2. 2

    Asks for action

    The user is asked to open an attachment, click a link or enter information. MITRE ATT&CK

  3. 3

    Runs the payload

    The attachment or downloaded file installs the malware through a script chain. MITRE ATT&CK

03

Real-world examples

TA547: Metro invoice impersonation

Rhadamanthys profile

Proofpoint reported that the TA547 group sent Rhadamanthys to German organizations with invoice emails impersonating the German retailer Metro, and that the PowerShell script used may have been generated by a large language model. Proofpoint

The PhantomVAI loader

Katz Stealer profile

Unit 42 documented that the PhantomVAI loader, formerly known as Katz Stealer Loader, distributed AsyncRAT, XWorm, FormBook and DCRat in phishing campaigns by hiding payloads inside images (steganography). Palo Alto Networks Unit 42

04

How to detect it

  • Script processes starting from Office, a PDF reader or an archive tool right after an attachment is opened. MITRE ATT&CK
05

What to do

  • Have email attachments and links inspected in an isolated environment before they are opened. MITRE ATT&CK
  • Use phishing-resistant multi-factor authentication; a code entered on a fake page is useless. MITRE ATT&CK
06

MITRE ATT&CK

T1566PhishingT1566.001Spearphishing AttachmentT1566.002Spearphishing LinkT1204.002User Execution: Malicious File
07

Related families and terms

Families

RhadamanthysDecliningKatz StealerActiveLumma StealerActive

Report

Infostealer Threat Report — October 2026

Terms

TyposquattingInfection chainMalvertising
08

Sources

  1. 1Phishing (T1566) · MITRE ATT&CK
  2. 2Spearphishing Attachment (T1566.001) · MITRE ATT&CK
  3. 3Spearphishing Link (T1566.002) · MITRE ATT&CK
  4. 4User Execution: Malicious File (T1204.002) · MITRE ATT&CK
  5. 5Phishing — glossary definition · NIST CSRC
  6. 6TA547 targets German organizations with Rhadamanthys · Proofpoint, 2024
  7. 7PhantomVAI loader delivers infostealers · Palo Alto Networks Unit 42, 2025
  8. 8Restrict Web-Based Content (M1021) · MITRE ATT&CK
  9. 9Multi-factor Authentication (M1032) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans