Your email gateway cannot filter a message that never touches it. MITRE T1566.003, Spearphishing via Service, is phishing delivered through third-party services instead of enterprise email. It is an initial access technique for Linux, macOS and Windows.
How attackers use it
MITRE describes messages sent through social media, personal webmail and other services the company does not control. These typically have looser security policies than an enterprise. The goal is to build rapport or interest. Adversaries create fake social media accounts and message employees with job opportunities, which gives a plausible reason to ask about services, policies and software in an environment.
A common pattern is building rapport on social media, then sending content to a personal webmail account the target uses on a work computer. That bypasses some work email restrictions, and the target is more likely to open a file they were expecting. If the payload fails, the adversary can keep chatting and help the target get it working.
How to detect it
The detections tie service use to what happens on the endpoint:
- External service logins, unexpected file writes and suspicious child processes from browsers or productivity apps.
- On Linux, non-enterprise mail or messaging in clients such as Thunderbird or Evolution, or in browsers, leading to downloads and then shell or interpreter processes.
- On macOS, iCloud Mail, Gmail or social apps followed by downloads and then osascript, Terminal or other abnormal child processes.
Web proxy logs showing a file download from a personal mail or social domain, followed by execution of that file, are a strong chain to alert on.
How to reduce the risk
MITRE lists five mitigations:
- User Training: teach users to spot social engineering and malicious links, including unsolicited job offers.
- User Account Management: strict policies and least privilege for accounts on third-party services, with regular access reviews.
- Antivirus/Antimalware: automatic quarantine of suspicious files.
- Restrict Web-Based Content: decide whether social media and personal webmail are needed for business, and consider blocking them if activity cannot be monitored well.
- Audit: log and review interactions with third-party messaging and collaboration services for suspicious links, downloads or file exchanges.
Check your own environment
- Can staff open personal webmail on work devices? Is that a decision or an accident?
- Do your proxy logs record file downloads from personal mail and social domains?
- Does your phishing training cover recruiter-style approaches on social platforms?
Quick check
Why is personal webmail on a work computer useful to an attacker?
It avoids restrictions on the work account, and a file received from a conversation feels expected.
