T1566.002Initial Access
Spearphishing Link
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect…
CVEs12
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.7
Reports1
Detections
4 Sigma rules tagged T1566.002Spearphishing LinkT1566.0024 general rules
- Potential Malicious Usage of CloudTrail System Managerhightest
- Suspicious Execution via macOS Script Editormediumtest
- Suspicious Email Delivered In Microsoft 365mediumexperimental
- EvilTokens PhaaS Kit Phishing Related Request - Proxylowexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Spearphishing Link
12 CVEs, by priority. Each link shows its badge.- CVE-2018-6882Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVRansomwarePublic exploitMedium · 6.1T1566.002Spearphishing LinkT1059Command and Scripting InterpreterAI mapping from the description · how it is exploited29.8%Top 1.8%76.9priority
- CVE-2015-5119Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1566.002Spearphishing LinkT1059.007JavaScript+3 more · 5 reportsMITRE CTID mapping of the KEV entry · how it is exploited98.6%Top 0.08%74.8priority
- CVE-2024-21413Microsoft Outlook Improper Input Validation VulnerabilityMicrosoft · Office OutlookKEVPublic exploitCritical · 9.8T1566.002Spearphishing LinkT1059Command and Scripting InterpreterMITRE CTID mapping of the KEV entry · how it is exploited94.7%Top 0.14%69.8priority
- CVE-2024-42009RoundCube Webmail Cross-Site Scripting VulnerabilityRoundcube · WebmailKEVPublic exploitCritical · 9.3T1566.002Spearphishing LinkT1056Input Capture+1 moreMITRE CTID mapping of the KEV entry · how it is exploited82.9%Top 0.33%69.4priority
- CVE-2023-2533PaperCut NG/MF Cross-Site Request Forgery (CSRF) VulnerabilityPaperCut · NG/MFKEVPublic exploitHigh · 8.8T1566.002Spearphishing LinkT1059Command and Scripting Interpreter+1 moreMITRE CTID mapping of the KEV entry · how it is exploited28.8%Top 1.9%68.8priority
- CVE-2024-27443Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitMedium · 6.1T1566.002Spearphishing LinkT1059.004Unix Shell+2 moreMITRE CTID mapping of the KEV entry · how it is exploited24.6%Top 2.1%66.8priority
- CVE-2025-48700Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVMedium · 6.1T1566.002Spearphishing LinkT1059.007JavaScript+1 moreAI mapping from the description · how it is exploited1.7%Top 23%62.7priority
- CVE-2019-3778Open Redirect in spring-security-oauth2MITRE CTID mapping of the CVE · how it is exploited16.6%Top 3%25.5priority
- CVE-2019-3788UAA redirect-uri allows wildcard in the subdomainMITRE CTID mapping of the CVE · how it is exploited0.8%Top 42%17.6priority
- CVE-2018-11067Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection VulnerabilityMITRE CTID mapping of the CVE · how it is exploited1.8%Top 21%15.7priority
- CVE-2020-15233OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addressesMITRE CTID mapping of the CVE · how it is exploited0.8%Top 43%15.6priority
- CVE-2020-5270Open redirection when using back parameter of PrestaShopMITRE CTID mapping of the CVE · how it is exploited0.8%Top 42%14.4priority