Phishing

What the technique is

Adversaries may send malicious content to users in order to gain access to their mobile devices. All forms of phishing are electronically delivered social engineering. Adversaries can conduct both non-targeted phishing, such as in mass malware spam campaigns, as well as more targeted phishing tailored for a specific individual, company, or industry, known as “spearphishing.” Phishing often involves social engineering techniques, such as posing as a trusted source, as well as evasion techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages. Mobile phishing may take various forms. For example, adversaries may send emails containing malicious attachments or links, typically to deliver and then execute malicious code on victim devices. Phishing may also be conducted via third-party services, like social media platforms. Adversaries may also impersonate executives of organizations to persuade victims into performing some action on their behalf. For example, adversaries will often use social engineering techniques in text messages to trick the victims into acting quickly, which leads to adversaries obtaining credentials and other information. Mobile devices are a particularly attractive target for adversaries executing phishing campaigns. […]

What MITRE says you would watch

• AN1791

  Mobile security products may provide URL inspection services that could determine if a domain being visited is malicious. Enterprises may be able to detect anomalous traffic originating from mobile devices, which could indicate compromise.

• AN1792

  Mobile security products may provide URL inspection services that could determine if a domain being visited is malicious. Enterprises may be able to detect anomalous traffic originating from mobile devices, which could indicate compromise.