Procedure examples

Bumblebee has relied upon a user downloading a file from a OneDrive link for execution.

Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.

ROAMINGHOUSE has been executed through luring victims into clicking links to download malicious ZIP files.

NETWIRE has been executed through convincing victims into clicking malicious links.

Emotet has relied upon users clicking on a malicious link delivered through spearphishing.

Gootloader has been executed through malicious links presented to users as internet search results.

Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns.

Snip3 has been executed through luring victims into clicking malicious links.

GuLoader has relied upon users clicking on links to malicious documents.

ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.

SocGholish has lured victims into interacting with malicious links on compromised websites for execution.

SpicyOmelette has been executed through malicious links within spearphishing emails.

Javali has achieved execution through victims clicking links to malicious websites.

TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.

Latrodectus has been executed through malicious links distributed in email campaigns.

Saint Bot has relied on users to click on a malicious link delivered via a spearphishing.

SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.

Kerrdown has gained execution through victims opening malicious links.

Grandoreiro has used malicious links to gain execution on victim machines.

Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.

PLEAD has been executed via malicious links in e-mails.

OutSteel has relied on a user to click a malicious link within a spearphishing email.

BackConfig has compromised victims via links to URLs hosting malicious content.

Melcoz has gained execution through victims opening malicious links.

KOCTOPUS has relied on victims clicking on a malicious link delivered via email.

Qilin has been executed by luring victims into clicking links in spearphishing emails.

AppleJeus's spearphishing links required user interaction to navigate to the malicious website.

QakBot has gained execution through users opening malicious links.

Hancitor has relied upon users clicking on a malicious link delivered through phishing.

Kali365 has directed victims to actor-controlled phishing pages through malicious links, initiating device code authorization flows or adversary-in-the-middle session capture.