Procedure examples

TrickBot has been delivered via malicious links in phishing e-mails.

Bumblebee has been spread through e-mail campaigns with malicious links.

Havoc has been distributed through ClickFix phishing campaigns.

Pony has been delivered via spearphishing emails which contained malicious links.

ROAMINGHOUSE has been distributed through phishing emails containing malicious OneDrive links.

NETWIRE has been spread via e-mail campaigns utilizing malicious links.

Emotet has been delivered by phishing emails containing links.

Squirrelwaffle has been distributed through phishing emails containing a malicious URL.

Snip3 has been delivered to victims through e-mail links to malicious files.

GuLoader has been spread in phishing campaigns using malicious web links.

Mispadu has been spread via malicious links embedded in emails.

SocGholish has been spread via emails containing malicious links.

SpicyOmelette has been distributed via emails containing a malicious link that appears to be a PDF document.

Javali has been delivered via malicious links embedded in e-mails.

Lumma Stealer has been delivered through phishing emails containing malicious links.

DarkGate is distributed in phishing emails containing links to distribute malicious VBS or MSI files. DarkGate uses applications such as Microsoft Teams for distributing links to payloads.

Latrodectus has been distributed to victims through emails containing malicious links.

Saint Bot has been distributed through malicious links contained within spearphishing emails.

Kerrdown has been distributed via e-mails containing a malicious link.

Grandoreiro has been spread via malicious links embedded in e-mails.

Bazar has been spread via emails with embedded malicious links.

Valak has been delivered via malicious links in e-mail.

OutSteel has been distributed through malicious links contained within spearphishing emails.

Melcoz has been spread through malicious links embedded in e-mails.

KOCTOPUS has been distributed as a malicious link within an email.

Qilin has been delivered via malicious links in spearphishing emails.

AppleJeus has been distributed via spearphishing link.

QakBot has spread through emails with malicious links.

Hancitor has been delivered via phishing emails which contained malicious links.

AADInternals can send "consent phishing" emails containing malicious links designed to steal users’ access tokens.

Kali365 has sent bulk phishing emails containing malicious hyperlinks that direct victims to actor-controlled landing pages impersonating services including SharePoint, OneDrive, Teams, DocuSign, and Adobe Acrobat Sign.