Phishing (Link-Based Payload Delivery)

Overview

Phishing (Link-Based Payload Delivery) is a social engineering technique where adversaries send deceptive messages containing malicious links to lure victims into initiating harmful actions. This technique is commonly used during the Initial Access phase of an attack lifecycle to deliver payloads or redirect users to compromised sites. Adversaries leverage it to exploit human trust and bypass technical controls by inducing users to execute malicious content.

Attack Objective

• Gain initial access to target systems or networks
• Support the Initial Access and Execution stages of the attack lifecycle
• Advance the attacker’s position by delivering payloads that enable further compromise or control

How the Technique Works

Adversaries craft messages—often emails or instant messages—that contain links appearing legitimate but redirect to malicious sites or trigger downloads of harmful payloads. When a user clicks the link, it may lead to the execution of malware, credential harvesting, or exploitation of browser or application vulnerabilities. This indirect delivery method reduces reliance on attachments and can evade some email security filters.

Common Methods & Variations

• Use of shortened URLs, homoglyphs, or domain spoofing to disguise malicious links
• Links directing to credential phishing pages, drive-by downloads, or exploit kits
• Variants targeting cloud services, webmail platforms, or enterprise portals
• Employing living-off-the-land techniques by redirecting to legitimate services hosting malicious content
• Custom landing pages designed to mimic trusted sites for credential harvesting

Indicators of Compromise (IOCs)

• Unusual URL patterns or domains in email or messaging logs
• Network traffic to known malicious or newly registered domains
• User agent anomalies or unexpected redirects in web proxy logs
• Endpoint detection of downloads or execution following link clicks
• Authentication attempts from suspicious locations following phishing events

Detection Strategies

• Monitoring email gateways and web proxies for suspicious URLs and domain reputation
• Behavioral analysis of user interactions with links, including anomalous download or execution events
• Correlation of network traffic with threat intelligence on phishing infrastructure
• Use of sandboxing to analyze link destinations and payload behavior
• Signature-based detection of known phishing URLs combined with heuristic analysis

Mitigation & Prevention

• Implement email filtering and URL reputation services to block malicious links
• Enforce multi-factor authentication to reduce credential compromise impact
• User training and awareness programs focusing on link verification and phishing recognition
• Deploy web proxies and DNS filtering to prevent access to known phishing sites
• Apply least privilege principles and endpoint protection to limit payload execution

Response Considerations

• Immediately isolate affected endpoints and block malicious domains or URLs
• Conduct thorough investigation to identify scope of compromise and lateral movement
• Reset credentials potentially exposed through phishing and monitor for suspicious activity
• Review and update detection rules and user training based on attack indicators
• Harden email and web security configurations to prevent recurrence

Related Techniques

• Phishing (Spearphishing Attachment) as an alternative delivery method
• Credential Access techniques such as Credential Dumping following successful phishing
• Execution techniques triggered by user interaction with delivered payloads
• Command and Control established after initial access via phishing

Mapping & References

• MITRE ATT&CK T1566.002 – Phishing: Spearphishing Link
• MITRE ATT&CK T1192 – Spearphishing Link
• Public advisories from cybersecurity organizations detailing phishing campaigns and detection methods
• Industry reports on evolving phishing tactics and payload delivery mechanisms