TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Huntress

Phishing Techniques Spotted: Email Examples & Red Flags

2026-03-16 · Read original ↗

ATT&CK techniques detected

12 predictions
T1566.002Spearphishing Link
97%
“impersonation remains one of the most effective phishing techniques, and knowing the phishing red flags is the best defense. many phishing emails try to build trusted brands into their lures, like microsoft. in fact, microsoft was a top common brand impersonated by threat actors …”
T1566.002Spearphishing Link
97%
“phishing techniques spotted : email examples & red flags in this article, we break down five real phishing email examples using the latest email phishing techniques, and share the phishing red flags that can help you spot phishing emails before they cause damage. picture this : i…”
T1566.002Spearphishing Link
93%
“the legitimate figma website ( figma. com ). on the backend, threat actors have set up the webpage to tell victims to view a document – and that then takes them to a fake microsoft login page. figure 7 : a legitimate website used in a lots attack lots helps attackers evade detect…”
T1566.002Spearphishing Link
91%
“, along with other file formats like html, hta, and lnk shortcut files. for this specific phish, the attached svg file opens in - browser and redirects the target to a fake microsoft login page. the attack relies on raccoon0365, a popular phishing kit, which gives attackers vario…”
T1566.002Spearphishing Link
87%
“t get phished up : how to spot phishing emails before it ' s too late knowing how to spot phishing emails and recognizing phishing red flags is the most reliable defense against these evolving phishing techniques. while the phishing emails above have different flavors, the overal…”
T1566.002Spearphishing Link
83%
“to update their incorrect delivery details. figure 6 : a fedex phishing email with an ascii qr code notably, this message in particular includes an ascii qr code. the qr code isn ’ t a static image ; rather, the threat actors are using ascii characters. to the recipient, these ch…”
T1566.002Spearphishing Link
79%
“click the button in the email that says “ keep password ” before entering your credentials on the webpage, closing your work laptop, and hurrying off. it only took 60 seconds and an urgent message on a friday night, but you ’ ve been phished. figure 1 : at the wrong moment, targe…”
T1566.002Spearphishing Link
71%
“this case linked to nypost. com, to redirect their targets. this effectively redirects the user from the legitimate ny post website to the attacker - controlled site ( which, in this example, is a fake microsoft sign - in page at bodasyestilo [. ] com ). bonus tradecraft : we ’ v…”
T1598.003Spearphishing Link
55%
“impersonation remains one of the most effective phishing techniques, and knowing the phishing red flags is the best defense. many phishing emails try to build trusted brands into their lures, like microsoft. in fact, microsoft was a top common brand impersonated by threat actors …”
T1566Phishing
41%
“sending an email that includes a phone number for the victim to call. the lure typically resolves around some sort of issue that the target needs to fix by calling the phone number. in the email below, the attacker claims to be from visa ( using the sender address [ email protect…”
T1566.001Spearphishing Attachment
39%
“notifications from trusted platforms. scammers thrive on a sense of urgency, and what can be more pressing than a missed work phone call? this plays into the continued success of the voicemail lure, where attackers send “ voicemail notifications ” via email, telling targets they …”
T1598.002Spearphishing Attachment
32%
“notifications from trusted platforms. scammers thrive on a sense of urgency, and what can be more pressing than a missed work phone call? this plays into the continued success of the voicemail lure, where attackers send “ voicemail notifications ” via email, telling targets they …”

Summary

From fake UPS shipping notifications to PayPal-themed callback phishing, here are the five top phishing techniques we’re seeing this year.