MITRE ATT&CK T1598.003: Spearphishing Link (Enterprise Tactic TA0043 - Reconnaissance)

What MITRE ATT&CK T1598.003: Spearphishing Link (Enterprise Tactic TA0043 - Reconnaissance) requires

MITRE ATT&CK T1598.003 (Spearphishing Link) is an Enterprise Reconnaissance sub-technique of T1598 (Phishing for Information). Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Affected platforms: PRE. MITRE-documented mitigations include M1017 User Training, M1054 Software Configuration. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-04, CA-07, CM-02, CM-06, IA-09, SC-07, SC-20, SC-44.

Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated: 2026-05-25

Primary source: https://attack.mitre.org/techniques/T1598/003/

SHA-256 integrity: e223bb28bbecc827bc82617be5d1c459c6d948012d2abe2d7b2209cf9b57956c

Primary Citations — 7 traced to source

• MITRE ATT&CK Technique T1598.003: Spearphishing Link (https://attack.mitre.org/techniques/T1598/003/)
• MITRE ATT&CK Tactic TA0043: Reconnaissance (https://attack.mitre.org/tactics/TA0043/)

+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

• Discovery (free): /api/v1/nodes/mitre-attack-t1598-003-spearphishing-link.json — 6-field metadata
• Vault (full node): /api/v1/vault/nodes/mitre-attack-t1598-003-spearphishing-link.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
• Canonical URL: https://bidda.com/intelligence/mitre-attack-t1598-003-spearphishing-link
• Back to registry: Browse all 10,085 compliance nodes