Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1566.004_spearphishing-voice
Adversaries may use voice communications to ultimately gain access to victim systems.
Passed 19 of 22 test cases with the skill, and 16 of 22 without it.
and 1 more in the full report
3 fixed16 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Can you conduct a defense evaluation to determine if callback phishing tactics could allow adversaries to achieve initial access on our endpoints? Analyze potential operating system indicators, evaluate our multi-factor authentication safeguards against phone-based deception, and provide a detailed diagnostic report with security recommendations.
| Checked | Without skill | With skill |
|---|---|---|
| Includes analysis for Linux operating systems. | Missed | Passed |
| Includes analysis for macOS operating systems. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1566
Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.
All forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on User Execution for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools (Remote Access Tools) onto their computer.
Adversaries may also combine voice phishing with Multi-Factor Authentication Request Generation in order to trick users into divulging MFA credentials or accepting authentication prompts.
Platforms: Linux, macOS, Windows, Identity Provider
Identify Attack Surface: Determine if the target environment is susceptible to Spearphishing Voice by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1566.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 16 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.