Technique:  Phishing:Spearphishing Link
AADInternals can send "consent phishing" emails containing malicious links designed to steal users’ access tokens.
AppleJeus has been distributed via spearphishing link.
It has sent spearphishing emails containing hyperlinks to malicious files.
It sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites.
It has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.
It has sent spearphishing emails containing malicious links.
It has sent spearphishing emails containing malicious links.
It has sent spearphishing emails containing links to .hta files.
It leveraged spearphishing emails with malicious links to initially compromise victims.
Bazar has been spread via emails with embedded malicious links.
It has used spearphishing e-mails with links to cloud services to deliver malware.
Bumblebee has been spread through e-mail campaigns with malicious links.
During C0011, It sent emails containing a malicious link to student targets in India.
During C0021, the threat actors sent phishing emails with unique malicious links, likely for tracking victim clicks.
It has sent emails with URLs pointing to malicious documents.
It has sent malicious links to victims through email campaigns.
It has sent spearphishing emails to potential targets that contained a malicious link.
It has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.
It has sent spearphishing emails containing malicious links.
Emotet has been delivered by phishing emails containing links.
It has sent spearphishing emails containing a link to a zip file hosted on Google Drive.
It has relied on victims to open malicious links in e-mails for execution.
It has used spearphishing emails (often sent from compromised accounts) containing malicious links.
It has conducted broad phishing campaigns using malicious links.
It has distributed targeted emails containing links to malicious documents with embedded macros.
Grandoreiro has been spread via malicious links embedded in e-mails.
GuLoader has been spread in phishing campaigns using malicious web links.
Hancitor has been delivered via phishing emails which contained malicious links.
Javali has been delivered via malicious links embedded in e-mails.
Kerrdown has been distributed via e-mails containing a malicious link.
It has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.
KOCTOPUS has been distributed as a malicious link within an email.
It has sent malicious links to victims via email.
It has used spam emails that contain a link that redirects the victim to download a malicious document.
It has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.
It has sent spearphishing emails containing a malicious Dropbox download link.
It has sent phishing emails that contain a link to an external server with ZIP and RAR archives.
It has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.
Melcoz has been spread through malicious links embedded in e-mails.
It delivered spearphishing emails with malicious links included.
It has sent phishing emails with malicious links included.
It has sent targeted spearphishing e-mails with malicious links.
It has delivered malicious links to their intended targets.
NETWIRE has been spread via e-mail campaigns utilizing malicious links.
During Night Dragon, threat actors sent spearphishing emails containing links to compromised websites where malware was downloaded.
It has sent spearphising emails with malicious links to potential victims.
During Operation Dream Job, It sent malicious OneDrive links with fictitious job offer advertisements via email.
During Operation Dust Storm, the threat actors sent spearphishing emails containing a malicious link.
During Operation Spalax, the threat actors sent phishing emails to victims that contained a malicious link.
OutSteel has been distributed through malicious links contained within spearphishing emails.
It has used spearphishing with links to deliver files with exploits to initial victims.
Pony has been delivered via spearphishing emails which contained malicious links.
QakBot has spread through emails with malicious links.
Saint Bot has been distributed through malicious links contained within spearphishing emails.
It has crafted phishing emails containing malicious hyperlinks.
It has sent e-mails with malicious links often crafted for specific targets.
Snip3 has been delivered to victims through e-mail links to malicious files.
SpicyOmelette has been distributed via emails containing a malicious link that appears to be a PDF document.
Squirrelwaffle has been distributed through phishing emails containing a malicious URL.
It has used spearphishing e-mails with malicious links to deliver malware.
It has sent spearphishing emails containing malicious links.
It has embedded links to malicious downloads in e-mails.
TrickBot has been delivered via malicious links in phishing e-mails.
It attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.
Valak has been delivered via malicious links in e-mail.
It has sent spearphishing emails with links to harvest credentials and deliver malware.
It has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.
ItM has used malicious links in e-mails to deliver malware.