Phishing: Spearphishing via Service

Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.

All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services.[1] These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services.

A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.

ID: T1566.003
Sub-technique of:  T1566
Tactic: Initial Access
Platforms: Linux, Windows, macOS
Version: 2.0
Created: 02 March 2020
Last Modified: 31 January 2024

Procedure Examples

ID Name Description
G0130 Ajax Security Team

Ajax Security Team has used various social media channels to spearphish victims.[2]

G0016 APT29

APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.[3]


CURIUM has used social media to deliver malicious files to victims.[4]

G0070 Dark Caracal

Dark Caracal spearphished victims via Facebook and Whatsapp.[1]


EXOTIC LILY has used the e-mail notification features of legitimate file sharing services for spearphishing.[5]

G0037 FIN6

FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.[6]

G0032 Lazarus Group

Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.[7]

G0059 Magic Hound

Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.[8][9][10]

S1100 Ninja

Ninja has been distributed to victims via the messaging app Telegram.[11]

G0049 OilRig

OilRig has used LinkedIn to send spearphishing links.[12]

C0022 Operation Dream Job

During Operation Dream Job, Lazarus Group sent victims spearphishing messages via LinkedIn concerning fictitious jobs.[13][14]

G1022 ToddyCat

ToddyCat has sent loaders configured to run Ninja as zip archives via Telegram.[11]

G0112 Windshift

Windshift has used fake personas on social media to engage and target victims.[15]


ID Mitigation Description
M1049 Antivirus/Antimalware

Anti-virus can also automatically quarantine suspicious files.

M1021 Restrict Web-Based Content

Determine if certain social media sites, personal webmail services, or other service that can be used for spearphishing is necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.

M1017 User Training

Users can be trained to identify social engineering techniques and spearphishing messages with malicious links.


ID Data Source Data Component Detects
DS0015 Application Log Application Log Content

Monitor for third-party application logging, messaging, and/or other artifacts that may send spearphishing messages via third-party services in an attempt to gain access to victim systems.

DS0029 Network Traffic Network Traffic Content

Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).

Network Traffic Flow

Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.