Phishing for Information: recognize the technique

Lesson Purpose

What you are learning

This technique uses deceptive messages to persuade someone to reveal information. The request may ask about people, internal processes, technology, credentials, or schedules. The message does not need malware to create risk. This lesson is about recognition and defense, not creating phishing messages.

Learning Objectives

Explain Phishing for Information in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

A suspicious message may look like an ordinary question from a coworker, vendor, recruiter, or support person. Independent verification is important before sharing sensitive information. In practice, defenders compare public information with internal records, logs, inventories, and monitoring data to decide whether the information is current, expected, and useful to an attacker. The goal is not to remove all public information, but to reduce unnecessary exposure and review information that could create avoidable security risk.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Useful evidence for a suspicious information-seeking message includes message headers, identity/account history, communication history, and independent contact or ticket records.
Verify whether the requester is who they claim to be and whether the request is expected and appropriate before sharing information.
Controls include independent verification, limiting sensitive disclosure, MFA/account protection, reporting procedures, and security awareness training.

This is ungraded practice. Use the lesson material above; exact wording is not required. Identify three evidence sources that could help investigate a suspicious information-seeking message. Then give two questions that help verify the request and two controls that reduce risk. Do not create or send phishing messages. No external target interaction is required.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Phishing for Information? This technique uses deceptive messages to persuade someone to reveal information. This technique is about using information from security vendors, researchers, and intelligence providers. This technique is about learning who works with an organization and how its accounts are named.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Email headers, sender-authentication results, secure-email events, link destinations, and reported messages Threat-intelligence feeds, vendor advisories, exposure reports, asset inventories, SIEM data, and incident records Login logs, account inventories, email-security events, and reports of exposed credentials

3. Which interpretation best avoids overstating what the observed information proves? A message does not need malware to be dangerous. Verify the sender and sensitive requests through trusted channels. Threat-vendor data is useful context, not proof. Combine it with current internal evidence. Public identity information can increase risk, but it is not the same as account compromise.

4. Consider this behavior: This technique uses deceptive messages to persuade someone to reveal information. The request may ask about people, internal processes, technology, credentials, or schedules. Which ATT&CK technique best matches the behavior? Phishing for Information Search Threat Vendor Data Gather Victim Identity Information

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Verify the sender through a trusted independent channel before sharing sensitive information Check whether the report applies to current organizational assets and confirm it with internal evidence Check whether unusual login or recovery activity followed the exposure, and use strong MFA and account-recovery controls

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? A message can create risk even when it contains no malware A vendor report does not automatically prove that the organization is exposed or compromised Knowing a person's name or email address does not prove that the account is compromised

Learning Moment

A message does not need malware to be dangerous. Verify the sender and sensitive requests through trusted channels.

Defender Perspective

Useful evidence includes email headers, sender-authentication results, secure-email events, link destinations, collaboration logs, reported messages, and identity events. Check whether the sender can be verified independently, whether the request fits normal business processes, and whether sensitive information was shared. Reduce risk with strong MFA, secure email controls, reporting tools, and verification procedures.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard