Phishing for Information
Information-seeking phishing attempts to extract useful information through deceptive messages.
What it means
Information-seeking phishing attempts to extract useful information through deceptive messages. The goal may be reconnaissance rather than immediate code execution.
MITRE ATT&CK catalogs this behavior as T1598, within reconnaissance. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.
An investigation example
A message asks an employee to confirm security settings or internal contact details under a fabricated business pretext.
Evidence to examine
Review the request, sender provenance, response content, and any follow-on targeting using the disclosed information.
A common analytical pitfall
A message without an attachment or executable link can still expose information useful to an adversary.
Response considerations
Verify requests through trusted channels and assess what was actually disclosed before deciding whether accounts or systems require further protection.
The immediate goal may be knowledge rather than access
A fictional employee receives a survey asking which remote-access product their team uses and who approves urgent support requests. The sender may be gathering information for a later operation rather than asking for a password immediately. A message can therefore be security-relevant even when it contains no attachment or login link.
Evaluate the requested information and the claimed relationship. A genuine vendor may need limited technical details, but an unsolicited request should not gain trust from branding or accurate staff names. Verify the request through a known channel and disclose only what the business relationship permits.
During investigation, distinguish an attempted request from confirmed disclosure. A delivered message does not prove anyone answered. A reply may contain only public information or may expose sensitive workflow details. Preserve relevant messages and determine the actual response before deciding the scope of impact.
Practice a verification decision
For a tabletop exercise, write a fictional support survey with a mixture of public and sensitive questions. Ask participants which information they can share, which requires approval, and how they would confirm the sender. Use invented product and staff names rather than collecting real internal details.
If information was disclosed, response may involve updating the relevant workflow or increasing scrutiny of a specific pretext, not only resetting passwords. The action should match what became known and how it could be misused. A strong report explains the sender's request, evidence of any disclosure, likely follow-on risk, and uncertainty. This keeps reconnaissance-oriented phishing distinct from credential theft while showing how the behaviors can connect in a longer campaign.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1598: Phishing for Information